background image

   6

Telegram transmission

3. Telegram transmission

3.1 Radio channel parameters

03925 transmits 

Bluetooth technology

 Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz … 2480MHz).

By default, 03925 will use the three BLE advertising channels (BLE Channel 37, 38 and 39) defined for transmission. The transmission of a radio telegram on these 
three advertising channels is called an Advertising Event.
Use of different radio channels within the frequency band from 2402 MHz to 2480 MHz is possible, see chapter 6.7.9.
The initialization value for data whitening is set as follows:

 For BLE channels is set according to specification (value = radio channel)

 For the custom radio channels the initialization value is equal to the offset from 2400 MHz (e.g. value = 3 for 2403 MHz)

Table 1 below summarizes radio channels supported by 03925.

Radio Channel

Frequency

Channel Type

BLE Radio Channel

37

2402 MHz

BLE Advertising Channel

0

2404 MHz

BLE Data Channel

1

2406 MHz

BLE Data Channel

10

2424 MHz

BLE Data Channel

38

2426 MHz

BLE Advertising Channel

11

2428 MHz

BLE Data Channel

12

2430 MHz

BLE Data Channel

36

2478 MHz

BLE Data Channel

39

2480 MHz

BLE Advertising Channel

Custom Radio Channels

40

2403 MHz

Custom Radio Channel

41

2405 MHz

Custom Radio Channel

77

2477 MHz

Custom Radio Channel

78

2479 MHz

Custom Radio Channel

3.2 Default radio transmission sequence

03925 transmits telegrams in its standard configuration by using so-called Advertising Events.
An advertising event is defined as the transmission of the same radio telegram on all selected radio channels (by default this would be on BLE Channel 37, 38 and 
39) one after another with minimum delay in between.
For reliability reasons, 03925 will send several (minimum two, maximum three) advertising events for each button input. The resulting transmission sequence is shown 
in Figure 4 below.

CH37

CH38

CH39

Pause

(20 ms)

CH37

CH38

CH39

Pause

(20 ms)

CH37

CH38

CH39

3.3 User-defined radio transmission sequences

In certain situations it might be desirable to transmit radio telegrams on channels other than the three advertising channels.
03925 therefore allows to select the radio channels to be used for the transmission of data telegrams and commissioning telegrams. The following transmission 
modes are supported:

 Both commissioning telegrams and data telegrams are transmitted on the advertising channels as three advertising events. This is the default configuration and 

described in chapter 3.2 above.

 Commissioning telegrams are transmitted on the advertising channels as three advertising events while data telegrams are transmitted in a user-defined sequence 

as described below.

 Both commissioning and data telegrams are transmitted in a user-defined sequence as described below.

Table 1 – 03925 supported radio channels

Figure 4 – Default radio transmission sequence

Содержание 03925

Страница 1: ...gy Low Energy standard radiofrequency transmitter energy harvesting sup ply powered by built in electrodynamic generator to complete with Eikon 20506 or 20506 2 Arké 19506 or 19506 2 or Plana 14506 or 14506 2 buttons 2 modules Installer Manual HOME AUTOMATION ...

Страница 2: ... 2 ...

Страница 3: ... 8 4 3 Header 8 4 4 Source address 8 4 5 Check Sum 9 4 6 Payload 10 4 7 Switch status encoding 10 4 8 03925 telegram authentication 10 5 Commissioning 12 5 1 NFC based commissioning 12 5 2 Camera based commissioning 12 5 3 Radio based commissioning 12 5 4 Factory Reset 14 6 NFC interface 15 6 1 Using the NFC interface 15 6 2 NFC interface functions 15 6 3 Configuration memory organization 17 6 4 M...

Страница 4: ...ansmitted This radio telegram transmits the status of all four contact nipples at the moment when the energy bow was pushed down or released 03925 radio telegrams are protected with AES 128 security based on a device unique private key Fig 1 03925 1 2 Technical data Antenna Integrated PCB antenna Max transmit power measured 0 4dBm 1 1mW Communication Range Guidance Only 75 m ideal line of sight 10...

Страница 5: ... different radio telegram It is therefore possible to distinguish between radio telegrams sent when the energy bar was pushed and radio telegrams sent when the energy bar was released By identifying these different telegrams types and measuring the time between pushing and releasing of the energy bar it is possible to distinguish between Long and Short button contact presses This enables simple im...

Страница 6: ... Custom Radio Channel 3 2 Default radio transmission sequence 03925 transmits telegrams in its standard configuration by using so called Advertising Events An advertising event is defined as the transmission of the same radio telegram on all selected radio channels by default this would be on BLE Channel 37 38 and 39 one after another with minimum delay in between For reliability reasons 03925 wil...

Страница 7: ...0 ms in between as shown in Figure 5 below CH_REG1 CH_REG2 CH_REG3 Pause 20 ms CH_REG1 CH_REG2 CH_REG3 Pause 20 ms CH_REG1 CH_REG2 CH_REG3 The format of CH_REG1 CH_REG2 and CH_REG3 is described in chapter 6 7 9 3 3 2 Two channels sequence The two channels radio transmission sequence removes transmission on the third radio channel selected by CH_REG3 and instead repeats the transmission once more f...

Страница 8: ...03925 supports two source address modes Static Source Address mode default In this mode the source address is constant but its lower 32 bit can be configured via NFC interface Private Resolvable Address mode NFC configurable In this mode the source address changes for each transmission 03925 uses by default Static Source Address mode Private Resolvable Address mode can be selected by setting the P...

Страница 9: ...it MSB LSB The prand value is encrypted using the IRK The lowest 24 bit of the result encrypted value are then used as hash The concatenation of 24 bit prand and 24 bit hash will be transmitted as 48 bit private resolvable source address The receiving device maintains a list of IRK for all transmitters that have been commissioned to work with it Whenever the receiving device receives a radio teleg...

Страница 10: ...used to authenticate 03925 radio telegrams as described in chapter 4 8 Figure 13 below illustrates the data telegram payload 0x0C 0x10 0xFF Manufacturer ID 0x03DA Sequence Counter 4 Byte Switch Status Optional Data 0 1 2 4 Byte Security Signature 4 Byte LEN TYPE 4 7 Switch status encoding The Switch Status field within the Payload data identifies the 03925 action button push or release 03925 uses ...

Страница 11: ...apture and retransmission of a valid message it is required that the receiver tracks the value of the sequence counter used by 03925 and only accepts messages with higher sequence counter values i e not accepts equal or lower sequence counter values for subsequent telegrams 4 8 1 Authentication implementation 03925 implements telegram authentication based on AES128 in CCM Counter with CBC MAC mode...

Страница 12: ...bed in chapter 5 3 and via the NFC interface For security critical applications where unauthorized users could have physical access to the switch it is therefore strongly recommended to change the security key to a new security key as part of the NFC based commissioning pro cess To do so follow the procedure outlined in chapter 6 7 4 For additional security NFC read out of the new security key can...

Страница 13: ...set to 0xFF to indicate a Manufacturer specific Data field Manufacturer ID 2 byte The Manufacturer ID field is used to identify the manufacturer of BLE devices based on assigned numbers By default this field is set to 0x03DA GmbH This field can be changed via the NFC configuration interface as described in chapter 6 7 5 Sequence Counter 4 byte The Sequence Counter is a continuously incrementing co...

Страница 14: ...sed The button contacts A0 A1 B0 and B1 can be released at any time after pressing the energy bow down i e it is no requirement to hold them as well for at least 10 seconds Upon detecting this input 03925 will restore the default settings of the following items Static Source Address Security Key and Security Key Write register Both registers will be restored to the value of the factory programmed ...

Страница 15: ...lock and PIN change functionality 6 2 NFC interface functions For a detailed description about the NFC functionality please refer to the ISO IEC 14443 standard For specific implementation aspects related to the NXP implementation in NT3H2111 please refer to the NXP documentation which at the time of writing was available under this link http cache nxp com documents data_sheet NT3H2111_2211 pdf The...

Страница 16: ...ade level 2 READY 2 state is exited after the SELECT command from cascade level 2 with the matching complete part of the UID has been executed The NFC tag then proceeds into ACTIVE state where the application related commands can be executed 6 2 5 ACTIVE state ACTIVE state enables read and write accesses to unprotected memory If access to protected memory is required then the tag can transition fr...

Страница 17: ...ization The 03925 configuration memory is divided into the following areas Public data Protected data In addition to that 03925 maintains a private configuration memory region used to store default parameters and confidential information which is not accessible to the user Figure 24 below illustrates the configuration memory organization used by 03925 NFC access without PIN NFC access with PIN Pub...

Страница 18: ...0 900 Protected 229 0xE5 916 PIN Code Write Only 6 5 Public data Public data can be read by any NFC capable device supporting the ISO IEC 14443 Part 2 and 3 standards No specific security measures are used to restrict read access to this data The following items are located in the public data area 03925 Product Name This is always PTM 215B 03925 Product ID This is an 8 byte field which is by defau...

Страница 19: ...terface with the old PIN code and then writing the new PIN code to page 0xE5 as described in chapter 6 3 1 6 6 2 Configuration of product parameters 03925 allows no direct modification of the following parameters Static Source Address Product ID Manufacturer ID Security Key In order to modify these parameters the user has to write the new value into specific registers Source Address Write Product ...

Страница 20: ...h BLE telegram By default the manu facturer ID is set to 0x03DA GmbH but it can be changed to a different OEM identifier Product ID and Manufacturer ID can be changed by following these steps 1 Write the desired Product ID 8 byte using HEX or ASCII encoding according to user choice into the Product ID Write register Setting the Product ID register to 0x0000000000000000 will cause 03925 not to upda...

Страница 21: ...00 6 6 9 Radio channel selection registers If the Custom Variant register is set to a value other than 0x00 then the radio channels for transmission are selected using the CH_REG1 CH_REG2 and CH_REG3 registers as described in chapter 3 3 Each of these registers is 1 byte wide and uses the encoding shown in Table 4 below Note that two channels types can be used Standard BLE radio channels BLE Chann...

Страница 22: ...ing the default PIN code This region should therefore not be used to store sensitive data 6 7 Private Data The private data area stores the following items Security Key Default settings The content of the private data area is not externally accessible 6 7 1 Security Key The Security Key field contains the 128 bit private key used for authenticating 03925 telegrams and for resolving private source ...

Страница 23: ...r configuration 03925 communicates user actions rocker push release using a sequence of advertising telegrams as described in chapter 3 In order to maximize the likelihood of reception of these telegrams it is necessary that the receiver is either permanently in receive mode on the selected radio chan nels or if this is not possible is in receive mode periodically on one of the chosen radio channe...

Страница 24: ...e WEEE Information for users If the crossed out bin symbol appears on the equipment or packaging this means the product must not be included with other general waste at the end of its working life The user must take the worn product to a sorted waste center or return it to the retailer when purchasing a new one Products for disposal can be consigned free of charge without any new purchase obligati...

Страница 25: ... 25 ...

Страница 26: ...Viale Vicenza 14 36063 Marostica VI Italy www vimar com 03925IEN 01 1806 ...

Отзывы: