10.3.1 IC (Industry Canada) Regulatory Statement
This device complies with Industry Canada licence-exempt RSS standard(s). Operation is subject to the
following two conditions:
(1) this device may not cause interference, and
(2) this device must accept any interference, including interference that may cause unde- sired operation of the
device.
Le présent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radio exempts de
licence.
L'exploitation est autorisée aux deux conditions suivantes :
(1) l'appareil ne doit pas produire de brouillage, et
(2) l'utilisateur de l'appareil doit accepter tout brouillage radioélectrique subi, même si le brouillage est
susceptible d'en compromettre le fonctionnement.”
A. Parsing SR-SBP2801-BLE-E radio telegrams
This appendix is intended as an example of how start to parse received SR-SBP2801-BLE-E radio telegrams.
Please refer to chapter 4 first for a description of the BLE frame structure
A.1 Data telegram example
We consider the following raw data telegram data captured from an Sunricher SR-SBP2801-BLE-E device:
D6 BE 89 8E 42 13 9F 1B 00 00 15 E2 0C FF DA 03 69 01 00 00 10 8A D6 C1 7E 16 EE 23
A.1.1 BLE frame structure
The message shown above can be parsed into the following components (keep in mind the little endian byte
order):
BLE Access Address (4 byte): 0x8E89BED6
BLE Frame Control (2 byte): 0x1342
Size of source a payload: 0x13 (19 byte)
Telegram type: Non-connectable Advertising
BLE Source Address (6 byte): 0xE21500001B9F
Length of payload (1 byte): 0x0C (12 byte)
Type of payload (1 byte): 0xFF (manufacturer-specific data)
Manufacturer ID (2 byte): 0x0A78 (Sunricher) Sunricher Payload (9 byte): 69 01 00 00 10 8A D6 C1 7E CRC (3
byte): 16 EE 23
A.1.2 Sunricher data telegram payload structure
The Sunricher data telegram payload can now be parsed as follows: Sequence Counter (4 byte): 0x00000169
Switch Status: 10 (Release of button B1)
Telegram Signature: C7 24 EA F0
A.2 Commissioning telegram example
We consider the following raw commissioning telegram data captured from an Sunricher
SR-SBP2801-BLE-E device:
D6 BE 89 8E 42 24 9F 1B 00 00 15 E2 1E FF DA 03 71 01 00 00 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12
A0 9F 1B 00 00 15 E2 9E 6D 7C
A.2.1 BLE frame structure
The message shown above can be parsed into the following components (keep in mind the little endian byte
order):
BLE Access Address (4 byte): 0x8E89BED6
BLE Frame Control (2 byte): 0x2442
Size of source a payload: 0x24 (36 byte)
Telegram type: Non-connectable Advertising
BLE Source Address (6 byte): 0xE21500001B9F
Length of payload (1 byte): 0x1E (30 byte)
Note that this field should correctly be set to 0x1D
This issue has been corrected in product version DC-06
Type of payload (1 byte): 0xFF (manufacturer-specific data)
Manufacturer ID (2 byte): 0x0A78 (Sunricher)
Sunricher Payload (27 byte): 71 01 00 00 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0 9F 1B 00 00 15 E2
CRC (3 byte): 0x7C6D9E
A.2.2 Sunricher commissioning telegram payload structure
The Sunricher commissioning telegram payload can now be parsed as follows:
Sequence Counter (4 byte): 0x00000171
Security Key: AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0
Static Source Address: 0xE21500001B9F
B. Address resolution for resolvable private addresses (RPA)
SR-SBP2801-BLE-E provides the option to obfuscate its identity by means of using resolvable private
addresses (RPA) as described in chapter 4.4.2. The following chapters describe how to re- solve such
addresses.
B.1.1 RPA resolution flow
The execution flow for resolving private addresses (RPA) is shown in Figure 43 below.
Figure 43 – Execution flow for resolving private addresses (RPA resolution)
Input to the RPA resolution flow is the prand part of the resolvable private address field of the received
telegram together with one (or several) locally stored IRK.
The receiver will then try for each locally stored IRK if the hash generated using the execution flow above
matches the hash part of the resolvable private address field of the received telegram. If it does, then the IRK
identifies the device from which this telegram originated.
B.1.2 Address resolution example
We consider a SR-SBP2801-BLE-E device with the following IRK (options for determining the IRK / security
key of a SR-SBP2801-BLE-E are described in chapter C.1.3.):
BE759A027A4870FD242794F4C45220FB
We further consider a telegram having the following resolvable private address:
493970E51944
We will now test if this resolvable private address was generated using the IRK above. Referring to the
resolvable private address structure shown in Figure 12, we split the re-solvable private address into prand
and hash as follows:
prand = (RPA && 0xFFFFFF000000) >> 24 prand = 0x493970
