USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE PTM 216B Bluetooth® Pushbutton Transmitter Module 17 March 2022 Observe precautions! Electrostatic sensitive devices! Patent WO98/36395, DE 100 25 WO 2004/051591, DE 103 WO 04/109236, WO 05/096482, WO 02/095707, US 6,747,573, US 7,019,241 © 2022 EnOcean | www.enocean.com F-710-017, V1.0 561, 01 678 DE A1, 101 protected: DE 50 128, 10309334, PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE REVISION HISTORY The following major modifications and improvements have been made to this document: Version Author Reviewer Date Major Changes 1.0 MKA MK 04.02.2022 Initial Release Published by EnOcean GmbH, Kolpingring 18a, 82041 Oberhaching, Germany www.enocean.com, info@enocean.com, phone +49 (89) 6734 6890 © EnOcean GmbH, All Rights Reserved The Bluetooth® word mark and logos are registered trademarks owned by the Bluetooth SIG, Inc.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE TABLE OF CONTENT 1. General description ........................................................................................ 6 Basic functionality ......................................................................................... 6 Technical data ............................................................................................... 7 Environmental conditions ................................................................
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 7. 6.2.3 READY 1 state ......................................................................................... 31 6.2.4 READY 2 state ......................................................................................... 31 6.2.5 ACTIVE state .......................................................................................... 31 6.2.6 Read command ....................................................................................
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.6 11. India Equipment Type Approval ................................................................ 70 Product history............................................................................................ 71 A. Parsing PTM 216B radio telegrams ................................................................. 72 Data telegram example ................................................................................ 72 A.1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 1. General description Basic functionality PTM 216B enables the realization of energy harvesting wireless switches for lighting, building or industrial automation control systems using Bluetooth® low energy technology. PTM 216B is uses the standard EnOcean PTM 210 form factor enabling quick integration into a wide range of designs. Key applications are wall-mounted or portable switches either with up to two rockers or up to four push buttons.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Technical data Antenna Integrated PCB antenna Max.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 2. Functional information Product overview The pushbutton transmitter module PTM 216B from EnOcean enables the implementation of wireless remote controls without batteries. It transmits Bluetooth Low Energy (BLE) data telegrams where the required energy is provided by a built-in electro-dynamic energy generator. The PTM 216B product outline with key functional components is shown in Figure 2 below.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Functional block diagram Button Contacts Data Processor RF Transmitter Ant NFC Pushed /Released Push / Release Detection Antenna DC Power Energy Bow N Power Converter S Figure 3 – Functional block diagram of PTM 216B Energy Bow / Power Generator Converts the motion of the energy bow into electrical energy Power Converter Converts the energy of the power generator into a stable DC supply voltage for the device electronics Processor Det
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE User Interface PTM 216B devices provide four button contacts. They are grouped into two channels (Channel A and Channel B) each containing two button contacts (State O and State I). The state of all four button contacts (pressed or not pressed) is transmitted together with a unique device identification (48 Bit device ID) whenever the energy bow is pushed or released.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 3. Telegram transmission Radio channel parameters PTM 216B transmits Bluetooth Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz … 2480MHz). By default, PTM 216B will use the three BLE advertising channels (BLE Channel 37, 38 and 39) defined for transmission. The transmission of a radio telegram on these three advertising channels is called an Advertising Event.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Default radio transmission sequence PTM 216B transmits telegrams in its standard configuration by using so-called Advertising Events. An advertising event is defined as the transmission of the same radio telegram on all selected radio channels (by default this would be on BLE Channel 37, 38 and 39) one after another with minimum delay in between.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 3.3.1 Supported radio transmission sequences PTM 216B supports the following user-defined sequences: Three channel sequence This sequence is similar to the default Advertising Event with the difference that the user can select the radio channels to be used. The three-channel sequence is described in chapter 3.3.2 below.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 3.3.3 Two-channel radio transmission sequence The two-channel radio transmission sequence removes transmission on the third radio channel (selected by TX_CHANNEL3) and instead repeats the transmission once more (four times in total). The PTM 216B telegram will in this mode be transmitted on the radio channel selected by TX_CHANNEL1 first, immediately followed by a transmission on the radio channel selected by TX_CHANNEL2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4. Telegram format PTM 216B transmits Bluetooth Low Energy (BLE) radio telegrams in the 2.4 GHz band. For detailed information about the Bluetooth Low Energy standard, please refer to the applicable specifications. Figure 9 below summarizes the BLE frame structure. Figure 9 – BLE frame structure The content of these fields is described in more detail below. Preamble The BLE Preamble is 1 byte long and identifies the start of the BLE frame.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Source address The 6 byte BLE Source Address (MAC address) uniquely identifies each PTM 216B product.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4.4.2 Resolvable private address mode For some applications it is desirable to obfuscate the origins of PTM 216B data telegrams in order to prevent tracking of its radio transmissions. This can be achieved by using resolvable private addresses (RPA) as defined in the Bluetooth Core Specification.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Whenever the receiver receives a data telegram with a resolvable private address (identified by the most significant bits of the address field being set to 0b10), it will itself generate a 24 bit hash from the 24 bit prand sequentially using each IRK known to it (i.e. the IRK of each device that has been learned into it). If an IRK matches (i.e.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Telegram payload PTM 216B can transmit two types of telegrams: Data telegrams The payload of data telegrams contains the switch status together with optional data (if applicable), the current sequence counter value and the resulting authentication signature Commissioning telegrams The payload of commissioning telegrams contains the private security key as well as the current value of the sequence counter and the device address The pay
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Security Signature (4 byte) The Security Signature is used to authenticate PTM 216B radio telegrams as described in chapter 4.6.3 Figure 14 below illustrates the data telegram payload. Figure 14 – Data telegram payload structure 4.6.2 Button action encoding The Switch Status field within the data telegram payload identifies the PTM 216B button action (button push or release).
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4.6.3 Commissioning telegram payload The payload of commissioning telegrams is 30 bytes long and consists of the following fields: Length (1 byte) The Length field specifies the combined length of the following fields. For PTM 216B commissioning telegrams, this field is set to 0x1D to indicate 29 byte of manufacturer-specific data. Note: In product versions prior to DC-06 this field was incorrectly set to 0x1E.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE PTM 216B data telegram authentication PTM 216B implements telegram authentication for transmitted data telegrams to ensure that only telegrams from transmitters using a previously exchanged security key will be accepted by the receiver. Authentication relies on a 32 bit telegram signature which is calculated as shown in Figure 17 below and exchanged as part of the radio telegram.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4.7.1 Authentication implementation PTM 216B implements data telegram authentication based on AES128 in CCM (Counter with CBC-MAC) mode as described in IETF RFC3610. At the time of writing, the RFC3610 standard could be found here: https://www.ietf.org/rfc/rfc3610.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 5. Commissioning Commissioning is the process by which PTM 216B is learned into a receiver (actuator, controller, gateway, etc.). The following two tasks are required in this process: Device identification The receiver needs to know how to uniquely identify this specific PTM 216B device. This is achieved by using a unique 48 Bit ID (Source Address) for each PTM 216B device as described in chapter 4.4.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE NFC-based commissioning All required PTM 216B parameters can be read via a suitable NFC reader and writer supporting the ISO/IEC 14443 Part 2 and 3 standards. The actual NFC implementation in PTM 216B uses a Mifare Ultralight tag. Commissioning via NFC should follow these steps: 1. Unlock PTM 216B using the default NFC PIN code 0x0000E215 2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Camera-based commissioning Each PTM 216B module contains an optically readable Commissioning Code implemented either as Data Matrix Code or as QR Code depending on the device revision. This Commissioning Code on the device label can be scanned by a suitable commissioning tool (e.g. smartphone or PC with DMC / QR code reader) to read the static source address and the security key of the device.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE To enter commissioning mode, start by selecting one button contact of PTM 216B. Any button of PTM 216B (A0, A1, B0, B1) can be used. This button is referred to as Button_X in Figure 20 above. Next, execute the following long-short-long sequence: 1. Press and hold the selected button together with the energy bar for more than 7 seconds before releasing it 2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Factory reset PTM 216B can be reset to its default settings by means of a factory reset. This ensures that PTM 216B can be reset to a known configuration in case the PIN for the NFC access has been lost or NFC access is not possible for other reasons In order to execute such factory reset, the rocker(s) and the switch housing have to be removed from the PTM 216B module.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6. NFC interface PTM 216B implements NFC Forum Type 2 Tag functionality as specified in the ISO/IEC 14443 Part 2 and 3 standards using an NXP NT3H2111 Mifare Ultralight tag. This NFC functionality can be used to access (read and write) the PTM 216B configuration memory and thereby configure the device as described in the following chapters. Chapter 6.1 below gives an introduction to the NFC functionality and options to use the NFC interface.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE NFC interface functions For a detailed description about the NFC functionality, please refer to the ISO/IEC 14443 standard. For specific implementation aspects related to the NXP implementation in NT3H2111, please refer to the NXP documentation which at the time of writing was available under this link: https://www.nxp.com/docs/en/data-sheet/NT3H2111_2211.pdf The following chapters summarize the different functions for reference purposes. 6.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.2.2 IDLE state IDLE is the waiting state after a Power-On Reset (POR), i.e. after the NFC tag has been introduced into the magnetic field of the NFC reader. The NFC tag exits the IDLE state towards the READY 1 state when either a REQA or a WUPA command is received from the NFC reader. REQA and WUPA commands are transmitted by the NFC reader to determine whether any cards are present within its working range.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.2.6 Read command The READ command requires a start page address, and returns the 16 bytes of four NFC tag pages (where each page is 4 byte in size). For example, if the specified address is 03h then pages 03h, 04h, 05h, 06h are returned. Special conditions apply if the READ command address is near the end of the accessible memory area. Figure 23 below shows the read command sequence. Figure 23 – NFC read command sequence 6.2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.2.8 Password authentication (PWD_AUTH) command The protected memory area can be accessed only after successful password verification via the PWD_AUTH command. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. Figure 25 below shows the password authentication sequence.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Using TWN4 as USB NFC reader Elatec RFID Systems provides a PC software called “Director” as part of their software support package. At the time of writing, this was available from this address: https://www.elatec-rfid.com/en/download-center/contact-form-twn4-devpack-sdk/ Figure 26 below shows the user interface of this software.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.3.1 Useful commands The following commands are especially useful: SearchTag(maximum ID bytes) Used to search for a connected tag and identify type and ID of such tag. This should always be used as first operation ahead of any read / write / authenticate actions.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Configuration memory organization The PTM 216B configuration memory is divided into the following areas: Public Protected data data In addition to that, PTM 216B maintains a private configuration memory region used to store default parameters and confidential information which is not accessible to the user. Figure 29 below shows the configuration memory structure used by PTM 216B.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE NFC memory address map The NFC-accessible configuration memory is organized in memory pages where each memory page is 4 byte wide. An NFC access reads 16 bytes (4 pages) or writes 4 bytes (one page). The addresses map of the configuration memory is shown in Table 2 below. The byte order is little endian, i.e. byte 0 will be read first and byte 3 last.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Public data Public data can be read by any NFC-capable device supporting the ISO/IEC 14443 Part 2 and 3 standards. No specific security measures are used to restrict read access to this data. The following items are located in the public data area: Product This is always Name ” “PTM216B OEM Name This is an 8 byte field which is by default set to “EnOcean®“ to identify EnOcean GmbH as the manufacturer of this module.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Protected data The following items are located in the protected data area: SOURCE_ADDRESS_WRITE register This 4-byte register is used to update the lower 4 byte of the Static Source Address, see chapter 6.7.4 OEM_NAME_WRITE This 8-byte register is used to update the Product ID, see chapter 6.7.7 MANUFACTURER_ID_WRITE register This 4-byte register is used to update the Manufacturer ID, see chapter 6.7.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.1 PIN code Protected data access is only possible after unlocking the configuration memory with the correct 32 bit PIN code. By default, the protected area is locked and the default pin code for unlocking access is 0x0000E215. The default pin code shall be changed to a user-defined value as part of the installation process.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.4 SOURCE_ADDRESS_WRITE register The SOURCE_ADDRESS_WRITE register is 4 byte wide and can be used to modify the lower 32 bit of the PTM 216B Static Source Address. The upper 16 bit of the PTM 216B Static Source Address are always fixed to 0xE215 to identify the device type. In order to do change the lower 32 bit of the Static Source Address, follow these steps: 1. Write 2. Set new the 3.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.6 Private Security Key mode PTM 216B provides a private security key mode for applications requiring high security. In this mode, it is possible to write a security key which subsequently is inaccessible via NFC and will not show up in commissioning telegram. In both cases, the security key will be set to all zeros. The written security key thereby is completely inaccessible externally.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE PTM 216B will determine that it should update OEM_NAME and MANUFACTURER_ID based on the setting of the UPDATE_OEM_MAN_ID flag and copy any non-zero value of the OEM_NAME_WRITE register to the OEM_NAME register and any non-zero value of the MANUFACTURER_ID_WRITE register to the MANUFACTURER_ID register. After that, PTM 216B will clear the UPDATE_OEM_MAN_ID flag to 0b0. 6.7.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.9 VARIANT register The VARIANT register is 1-byte wide and allows selection of the custom radio transmission modes as described in chapter 3.3. Additionally, it allows reducing the transmission interval from 20 ms to 10 ms and to increase the bit rate from 1 Mbit to 2 Mbit. The structure of the VARIANT register is shown Figure 31 below.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.9.2 Interval selection The INTERVAL field allows reducing the transmission interval from the default setting of 20 ms to 10 ms. INTERVAL Behavior 0b0 20 ms Interval (Default configuration) 0b1 10 ms Interval Table 4 – INTERVAL settings 6.7.9.3 Data rate selection It is possible to increase the data rate from the default setting of 1 Mbit (standard BLE) to 2 Mbit proprietary mode using the DATA_RATE field.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.10 Radio channel selection registers If the TRANSMISSION_MODE field of the Variant register is set to a value other than 0x00 then the radio channels for transmission are selected using the registers CH_REG1, CH_REG2 and CH_REG3 as described in chapter 3.3. The CH_REG1, CH_REG2 and CH_REG3 registers are 1 byte wide and use the encoding shown in Table 6 below.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.11 Customer Data PTM 216B allocates 64 pages (256 byte) for customer data that can be read and written via the NFC interface in protected mode. The main intention is to enable storing OEM-specific information such as product type, revision, date code or similar. There is however no restriction (other than the maximum size of 256 byte) on the type of content that can be stored in this memory region.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Private data The private data area stores the following items: Security Key Default settings The content of the private data area is not externally accessible. 6.8.1 Security key The Security Key field contains the 128 bit private key used for authenticating PTM 216B telegrams and for resolving private source addresses. This register is programmed with a random value during manufacturing.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 7. PTM 216B device label Each PTM 216B module contains a device label. Note that the finished switches (EWSSB, EWSDB, ESRPB and EDRPB) use a different product label as described in their user manuals and the information given in the subsequent chapters applies only to the PTM 216B module itself. PTM 216B device label structure Figure 32 below shows the structure of the PTM 216B device label.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE QR code format The QR code used in the PTM 216B product label encodes key product parameter according to the ANSI/MH10.8.2-2013 industry standard. The QR code shown in Figure 32 above encodes the following string: 30SE21501500100+Z0123456789ABCDEF0123456789ABCDEF+30PS3221-A216+2PDC06+S01234567890123 Table 7 below describes the ANSI/MH10.8.2 data identifiers used by the PTM 216B device label and shows the interpretation of the data therein.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 8. Device integration PTM 216B is designed for integration into button or rocker-based switches. It implements the established PTM 2xx mechanical form factor and can therefore be used with a wide variety of existing designs. Mechanical interface characteristics Energy bow travel / operating force 1.8 mm / typ. 9 N At room temperature Only one of the two energy bows may be actuated at the same time! Restoring force at energy bow typ. 0.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 1) these catwalks are not needed when using one single rocker only 2) dimensions of rocker part Figure 34 – PTM 216B, top view (note cut A, B and C marking) © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Figure 35 – PTM 216B, cut A 2) dimensions of rocker part Figure 36 – PTM 216B, cut B and C © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Hatched areas: support planes Figure 37 – PTM 216B rear view © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 2) dimensions of rocker part Figure 38 – PTM 216B, side view If the rocker is not mounted on the rotation axis of PTM 216B several tolerances have to be considered! The measure from support plane to top of the energy bow is 7.70 mm +/- 0.3 mm! The movement of the energy bow must not be limited by mounted rockers! Catwalks of the switch rocker must not exert continuous forces on the button contacts! © 2022 EnOcean | www.enocean.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE It is required to use non-conductive material (no metal or plastic with metal or graphite elements) for the rockers, the frame and the base plate to ensure best transmission range. PTM 216B is powered by the electromagnetic generator ECO 200. For proper function magnets or ferromagnetic materials are not permitted within a keep-out zone of 60mm around the center of PTM 216B. © 2022 EnOcean | www.enocean.com F-710-017, V1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE OEM product QR code Customers integrating PTM 216B modules into their own OEM products should include a QR code on their product label for the purpose of commissioning as described in chapter 5.2. This QR code can then be scanned by commissioning tools to automatically extract the required product parameters. The QR code has to use to the ANSI/MH10.8.2-2013 industry standard with the syntax described in chapter 7.2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 9. Application information Transmission range The main factors that influence the system transmission range are: - Type and location of the antennas of receiver and transmitter - Type of terrain and degree of obstruction of the link path - Sources of interference affecting the receiver - “Dead spots” caused by signal reflections from nearby conductive objects.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Receiver configuration PTM 216B communicates user actions (rocker push / release) using a sequence of advertising telegrams as described in chapter 3. In order to maximize the likelihood of reception of these telegrams, it is necessary that the receiver is either permanently in receive mode on one of the radio channels used by PTM 216B or – if this is not possible – periodically in receive mode for a sufficiently long duration.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 9.2.1 Advertising interval PTM 216B transmits advertising events with an advertising interval of either 20 ms (default setting) or 10 ms (NFC configurable setting). The time required to transmit each advertising telegram within the advertising event is approximately 0.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 9.2.3 Scan interval The scan interval has to be selected such that the receiver will not be inactive so long that it misses all three advertising events. The longest period for which the receiver can be inactive is given by the time between the end of the first advertising events (assuming that the receiver exactly misses the last bit of it) and the beginning of the third advertising event (so that this will certainly be received).
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10. Regulatory information PTM 216B has been certified according to FCC (US), ISED (CA) and RED (EU) regulations. Changes or modifications not expressly approved by EnOcean could void the user's authority to operate the equipment. RED for European Market The Radio Equipment Directive (2014/53/EU, typically referred to as RED) replaces R&TTE directive as regulatory framework for radio products in the European Union.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE FCC (United States) Certificate © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.2.1 FCC (United States) Regulatory Statement This device complies with Part 15 of the FCC rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference, and 2. This device must accept any interference received, including interference that may cause undesired operation.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE IC (Industry Canada) Certificate © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.3.1 IC (Industry Canada) Regulatory Statement 10.3.1.1 English version WARNING: Changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. This device complies with Industry Canada license-exempt RSS standard(s). Operation is subject to the following two conditions: 1. This device may not cause interference, and 2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.3.1.2 French version PRUDENCE: Changements ou modifications pourraient annuler le droit de l'utilisateur à utiliser l'équipement non autorisées. Le présent appareil est conforme aux CNR d’Industrie Canada applicables aux appareils radio exempts de licence. L’exploitation est autorisée aux deux conditions suivantes: 1. L’appareil ne doit pas produire de brouillage, et 2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE ACMA (Australia) Declaration of Conformity © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE ARIB (Japan) Construction Type Conformity Certifaction © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.6 India Equipment Type Approval © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 11. Product history Table 10 below lists the product history of PTM 216B. Revision DA-01 Release date March 2022 Key changes versus previous revision First release for lead customers Table 10 – Product History © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE A. Parsing PTM 216B radio telegrams This appendix is intended as an example of how start to parse received PTM 216B radio telegrams. Please refer to chapter 4 first for a description of the BLE frame structure Data telegram example We consider the following raw data telegram data captured from an EnOcean PTM 216B device: D6 BE 89 8E 42 13 9F 1B 00 00 15 E2 0C FF DA 03 69 01 00 00 10 8A D6 C1 7E 16 EE 23 A.1.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Commissioning telegram example We consider the following raw commissioning telegram data captured from an EnOcean PTM 216B device: D6 BE 89 8E 42 24 9F 1B 00 00 15 E2 1E FF DA 03 71 01 00 00 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0 9F 1B 00 00 15 E2 9E 6D 7C A.2.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE B. Address resolution for resolvable private addresses (RPA) PTM 216B provides the option to obfuscate its identity by means of using resolvable private addresses (RPA) as described in chapter 4.4.2. The following chapters describe how to resolve such addresses. B.1.1 RPA resolution flow The execution flow for resolving private addresses (RPA) is shown in Figure 43 below. 0000000...
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE B.1.2 Address resolution example We consider a PTM 216B device with the following IRK (options for determining the IRK / security key of a PTM 216B are described in chapter C.1.3.): BE759A027A4870FD242794F4C45220FB We further consider a telegram having the following resolvable private address: 493970E51944 We will now test if this resolvable private address was generated using the IRK above.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C. Authentication of PTM 216B data telegrams PTM 216B provides the option to authenticate its data telegrams as described in chapter 4.6.3. The authentication mechanism used by PTM 216B is standardized as RFC3610. The full RFC3610 specification could be found here at the time of writing and should be used as primary source of information: https://www.ietf.org/rfc/rfc3610.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.2 Variable input parameters The RFC3610 implementation in PTM 216B requires four variable input parameters: Source address The 6 byte source address used to identify the sender of an authenticated message. The source address is required in little endian (least significant byte first) format.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.3 Obtaining the security key All required parameters except the security key can be directly extracted from the received message that shall be authenticated. The security key –the common secret shared between sender and receiver – has to be obtained via specific mechanisms.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.3.2 Obtaining the security key via the product QR code Each PTM 216B module contains a QR code on its product label which identifies source address and security key of the module as described in chapter 8.3. The QR code of the device used for this tutorial is shown in Figure 44 below shows the same information encoded according to that.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.4 Internal parameters The RFC3610 implementation in PTM 216B derives a set of internal parameters for further processing from the provided input parameters.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.6 Variable internal parameters The RFC3610 implementation in PTM 216B derives four internal parameters – Nonce, A0, B0 and B1 – based on the telegram specific input data and the constant internal parameters. These variable internal parameters - listed in Table 14 below - are then used together with the security key to calculate the actual signature.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3 Examples The following four chapters give step by step examples based on one actual device and 0 / 1 / 2 or 4 byte of optional data. C.3.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE The execution sequence would then be as follows: X_1 = AES128(B0, Key) X_1 = AES128(49B819000015E25D0400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_1 = 41ef09792ae152ae52c671435c1f247d X_1A = XOR(X_1, X_1A = XOR(41ef09792ae152ae52c671435c1f247d, 00090CFFDA035D040000110000000000) X_1A = 41e60586f0e20faa52c660435c1f247d B_1) X_2 = AES128(X1A, Key) X_2 = AES128(41e60586f0e20faa52c660435c1f247d, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_2 = 8d8
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3.2 Data telegram with 1 byte optional data For this example, we consider the following telegram payload received from a PTM 216B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0D FF DA 03 62 04 00 00 10 12 B9 FE AC C1 The last four bytes of this payload (B9 FE AC C1) are the sender-provided signature which has to be authenticated.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3.3 Data telegram with 2 byte optional data For this example, we consider the following telegram payload received from a PTM 216B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0E FF DA 03 63 04 00 00 11 12 34 52 E0 51 16 The last four bytes of this payload (52 E0 51 16) are the sender-provided signature which has to be authenticated.
USER MANUAL PTM 216B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3.4 Data telegram with 4 byte optional data For this example, we consider the following telegram payload received from a PTM 216B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 10 FF DA 03 6A 04 00 00 10 12 34 56 78 2C 9E 10 95 The last four bytes of this payload (2C 9E 10 95) are the sender-provided signature which has to be authenticated.
