USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER PTM 535BZ Bluetooth® and Zigbee Green Power Pushbutton Transmitter 06.07.2022 Observe precautions! Electrostatic sensitive devices! Patent protected: WO98/36395, DE 100 25 561, DE 101 50 128, WO 2004/051591, DE 103 01 678 A1, DE 10309334, WO 04/109236, WO 05/096482, WO 02/095707, US 6,747,573, US 7,019,241 © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 535BZ User Manual | v1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER REVISION HISTORY The following major modifications and improvements have been made to this document: Version 1.0 1.1 Author MKA MKA 1.2 MKA Reviewer Date Major Changes RS, EG, MK 12.05.2021 First public release MKA 26.05.2021 Added NFC PIN HASH description and calculation example MKA 06.07.2022 Added FCC and ISED certification Published by EnOcean GmbH, Kolpingring 18a, 82041 Oberhaching, Germany www.enocean.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER TABLE OF CONTENT 1 1.1 1.2 1.3 1.4 1.5 2 2.1 2.2 2.3 2.4 2.5 3 3.1 3.2 3.3 3.4 4 4.1 4.2 4.3 4.4 4.5 5 General description ........................................................................................ 6 Basic functionality ......................................................................................... 6 Technical data ................................................................................
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.1.1 Useful commands .................................................................................... 86 A.1.2 Translation into binary data ...................................................................... 86 A.1.3 Direct communication with the NFC reader ................................................. 87 A.2 Configuration examples ............................................................................
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER C. D. E. F. B.1.1 Advertising interval ................................................................................ 108 B.1.2 Scan window ......................................................................................... 108 B.1.3 Scan interval......................................................................................... 109 B.1.4 Summary ........................................................
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 1 1.1 General description Basic functionality PTM 535BZ enables the realization of energy harvesting wireless switches for lighting, building or industrial automation control systems using Bluetooth® Low Energy (BLE) or Zigbee Green Power (ZGP) technology.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 1.2 Technical data Radio Standards 2.4 GHz Bluetooth Low Energy (default setting) 2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 2 2.1 Functional information Product overview The transmitter module PTM 535BZ from EnOcean enables the implementation of wireless buttons and switches without batteries. It transmits Bluetooth Low Energy (BLE) or Zigbee Green Power (ZGP) data telegrams where the required energy is provided by an external electro-dynamic energy generator such as the kinetic harvester ECO 200. 2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 2.3.1 Key components PTM 535BZ uses the following main components to achieve the desired product functionality: ECO 200 energy harvester Converts the kinetic energy (press / release) into electrical energy and is used to power PTM 535BZ in self-powered applications. Alternatively, a power supply might be used.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 2.4.1 Energy harvester interface PTM 535BZ is designed to operate based on the energy supplied by a kinetic energy harvester such as ECO 200. Refer to [1] for a description of ECO 200. ECO 200 provides the harvested energy to PTM 535BZ using its AC1 and AC2 output pins.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 2.4.2 External inputs PTM 535BZ provides two electrical inputs called INPUT1 and INPUT2 and will report the status of these input pins as part of each data telegram. These signals can for instance be used for external contacts or switches.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 2.5 Security Keys PTM 535BZ authenticates data telegrams based on an authentication signature as described in Chapter 3.4.2 for BLE data telegrams and in Chapter 4.4.4 for ZGP data telegrams. In addition to that, PTM 535BZ provides for BLE data telegrams the option to obfuscate the sender identity by using Resolvable Private Addresses that are generated using an Identity Resolution Key as described in Chapter 3.3.5.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3 Bluetooth Low Energy (BLE) radio By default, PTM 535BZ is configured to transmit BLE telegrams. The format of these telegrams is the similar to the format used by PTM 215B. Refer to [2] for a detailed description of the BLE telegram format.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.1 Radio parameters PTM 535BZ transmits Bluetooth Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz … 2480MHz) as defined in [2]. 3.1.1 Bit rate By default, PTM 535BZ uses a bit rate of 1 Mbit/s as defined in [2]. PTM 535BZ also supports a custom bit rate of 2 Mbit/s which can be selected via the NFC interface as described in Chapter 5.6.3.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 2.4 GHz ISM Band CH78 (2479 MHz) CH77 (2477 MHz) CH76 (2475 MHz) BLE Advertising Channel CH39 (2480 MHz) CH36 (2478 MHz) CH35 (2476 MHz) BLE Data Channel CH34 (2474 MHz) CH54 (2431 MHz) ... CH13 (2432 MHz) CH53 (2429 MHz) CH12 (2430 MHz) CH52 (2427 MHz) CH11 (2428 MHz) CH51 (2425 MHz) CH38 (2426 MHz) CH50 (2423 MHz) CH10 (2424 MHz) CH49 (2421 MHz) 2400 MHz CH09 (2422 MHz) CH 37 (2402 MHz) ...
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.2 Radio transmission sequence PTM 535BZ transmits BLE telegrams in its standard configuration by using so-called BLE Advertising Events as defined in [2]. Each data or commissioning telegram is transmitted as a sequence of redundant advertising events which all contain the same telegram payload. For reliability reasons, PTM 535BZ will send each telegram using several (minimum two) BLE advertising events.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.3 Telegram format PTM 535BZ transmits Bluetooth Low Energy (BLE) radio telegrams in the 2.4 GHz band. This chapter provides a summary of the BLE frame structure; for detailed information please refer to [2]. Figure 7 below summarizes the high-level BLE frame structure. The content of these fields is described in more detail below. Figure 7 – BLE frame structure 3.3.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.3.5 Source address The six-byte source address identifies the originator (sender) of BLE telegrams. PTM 535BZ supports using either static source addresses or resolvable private addresses. By default, PTM 535BZ uses static source addresses. PTM 535BZ can be configured to use resolvable private addresses as described in Chapter 5.6.4.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.3.5.2 Resolvable private address For some security-critical applications it might be desirable to prevent unauthorized tracking of PTM 535BZ devices based on the source address used for their radio transmissions. At the same time, PTM 535BZ devices must be unambiguously identifiable by the receiver.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER The receiver will identify the transmitter based on the IRK that is used to generate the hash value from the prand value. When a transmitter is commissioned (learned in) to a receiver, the transmitter therefore has to communicate its IRK to the receiver. The receiver maintains a list of all IRK (one per transmitter) that have been commissioned.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.4.1.1 Input status encoding The INPUT_STATUS field within the data telegram payload identifies the ECO 200 action (press or release) and the status of the external signals INPUT1 and INPUT2 (connected to GND or not connected to GND). PTM 535BZ uses the following sequence to identify and transmit button contact status: 1. Determine direction of the ECO 200 movement (press or release) 2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.4.1.2 Custom INPUT_STATUS encoding PTM 535BZ enables the user to define (via the NFC interface) different values to be transmitted in the INPUT_STATUS field for some or all of the eight possible input events shown in Table 2 above.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.4.2 BLE data telegram authentication PTM 535BZ implements telegram authentication for transmitted BLE data telegrams to ensure that only telegrams from transmitters using a previously exchanged security key will be accepted by the receiver. Authentication of BLE data telegrams relies on a 32 bit telegram signature which is calculated as shown in Figure 16 below and exchanged as part of the radio telegram.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.4.2.1 Authentication implementation PTM 535BZ implements data telegram authentication as described in IETF RFC3610 [4]. The 13 Byte Nonce (number used once – unique) initialization value is constructed as concatenation of 6 byte Source Address, 4 byte Sequence Counter and 3 bytes of value 0x00 (for padding). Note that both Source Address and Sequence Counter use little endian format (least significant byte first).
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 3.4.3 Commissioning telegram payload The payload of commissioning telegrams is 30 bytes long and consists of the following fields: Length (1 byte) The Length field specifies the combined length of the following fields. For PTM 535BZ commissioning telegrams, this field is always set to 0x1D to indicate that 29 byte of manufacturer-specific data follow.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4 Zigbee Green Power (ZGP) radio PTM 535BZ can be configured via the NFC interface to transmit telegrams using the Zigbee Green Power (ZGP) standard [3] instead of using the BLE standard.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.1 Radio channels PTM 535BZ transmits ZGP telegrams on one of the sixteen IEEE 802.15.4 radio channel within the 2.4 GHz radio frequency band (2402MHz … 2480MHz). The IEEE 802.15.4 radio channel assignment is shown in Table 4 below. Primary channels (marked bold) are specified as preferred channels for the transmission of ZGP telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.2 Radio transmission sequence PTM 535BZ transmits ZGP data telegrams as a set of redundant transmissions where the same data telegram is transmitted 3 times. The timing interval between the start of two consecutive redundant data telegrams is approximately 2.5 ms and varies by some random timing offset. Figure 20 below shows the ZGP radio transmission sequence used by PTM 535BZ for data telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.3 Telegram format PTM 535BZ transmits ZGP radio telegrams in the 2.4 GHz band according to the Zigbee Green Power specification [3] which uses IEEE 802.15.4 [5] as lower layer standard. Please refer to these specifications for detailed, up to date information. Figure 22 below summarizes the high-level IEEE 802.15.4 / Zigbee Green Power frame structure.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.3.3.1 Frame Length The Frame Length of the 802.15.4 frame depends on the telegram type (data telegram or commissioning telegram), the Device ID (identifying the device type as described in Chapter 4.4.1.1) and the length of the command list transmitted as part of the commissioning telegram (as discussed in Chapter 4.4.2.3). Table 5 below lists the telegram length for the supported telegram types.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.4 IEEE 802.15.4 MAC payload (ZGP telegram) The IEEE 802.15.4 MAC payload contains the ZGP telegram data. Figure 25 below shows the ZGP telegram format. Figure 25 – ZGP telegram format The content of the ZGP telegram data field depends on the telegram type (ZGP data telegram or ZGP commissioning telegram). Some of the fields shown in Figure 25 above are not used in all telegram types.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER ZGP command (2 byte or 1 byte) The ZGP command identifies the switch action. Format and encoding used by the ZGP command depend on the selected device ID. Security Signature (4 byte) The Security Signature is used to authenticate PTM 535BZ ZGP radio telegrams as described in chapter 4.4.4 4.4.1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.4.1.2 Device ID 0x07: Generic 8-contact Switch Device ID 0x07 (Generic 8-contact Switch) is the default configuration used by PTM 535BZ when transmitting ZGP data telegrams. Figure 27 below illustrates the ZGP command structure used by generic switch data telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.4.1.3 Device ID other than 0x07 It is possible to configure PTM 535BZ via NFC to use one of the alternative Device ID listed in Table 6 instead of the default Device ID 0x07. The ZGP specification [3] defines the minimum set of commands that must be supported for each Device ID but leaves it up to the user to define which input actions trigger these commands.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.4.2 Commissioning telegram Transmission of a commissioning telegram can be selected either by pressing the LRN button or via the NFC interface. The commissioning telegram payload is shown in Figure 28 below.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.4.2.1 Application Information PTM 535BZ provides Application Information according to the ZGP specification [3] as part of the commissioning telegram to describe the command set used by it. It is possible to disable the transmission of the Application Information field for Device ID other than 0x07 via NFC to maintain backwards compatibility to older ZGP implementations.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER The Generic Switch Configuration field which identifies the type of switch and the number of supported switch contacts. It is by default set to 0x01 (unknown switch type, one switch contact) as the majority of PTM 535BZ applications are single push buttons or position switches. The number of contacts can be changed to other values via the NFC interface as described in Chapter 5.6.11.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.4.3 Decommissioning telegram Transmission of a decommissioning telegram can be selected only via the NFC interface. The payload of decommissioning telegrams is 12 byte long and shown in Figure 34 below. Figure 34 – Structure of ZGP decommissioning telegrams For security reasons, SECURITY_KEY2 will be automatically updated by PTM 535BZ to a new random value when a decommissioning request is transmitted.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.5.1 Channel selection via NFC The radio channel used by PTM 535BZ can be selected via the NFC interface. To do so, the user first needs to determine the radio channel used by the ZGP network that shall receive the radio telegrams of PTM 535BZ.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 4.5.2.1 Channel selection sequence The channel selection sequence will always start with the radio channel that is currently used by PTM 535BZ. This allows to communicate the identify of PTM 535BZ to additional devices in the same ZGP network (for instance to newly added devices or to devices that did not receive the initial Commissioning Telegram).
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5 NFC configuration PTM 535BZ provides an NFC interface according to the ISO15693 standard for identifying and configuring device parameters. The NFC interface provides a textual description of key device parameters in NFC Data Exchange Format (NDEF), a register-based description of the current device configuration and a configuration update service with two permission levels. 5.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.1.1 Users The NFC interface architecture of PTM 535BZ supports two different users with different levels of access rights. The user with the higher level access rights is called USER1; the user with the lower level access rights is called USER2. USER1 has the right to change all available configuration options. The available configuration options for USER1 are defined by the register USER1_CONFIGURATION_OPTIONS.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.1.3 NFC configuration PTM 535BZ operation is configured using NFC configuration registers. PTM 535BZ will operate according to the settings of these registers. The currently active configuration registers are allocated in the ACTIVE CONFIGURATION area. The structure of the ACTIVE CONFIGURATION area is replicated in the NEW CONFIGURATION area.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.1.4 NFC functional requests In addition to changing registers in the current configuration, USER1 and USER2 can also request the transmission of a commissioning telegram by PTM 535BZ, the transmission of a ZGP decommissioning telegram (if PTM 535BZ is configured to transmit ZGP telegrams) or request a factory reset of the PTM 535BZ configuration registers to their default values. 5.1.4.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.2 NFC memory map The NFC memory is organized in pages (smallest addressable unit) where each page contains 4 byte of data. Several pages with similar functionality form an NFC memory area.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.3 PRODUCT NDEF The PRODUCT NDEF area contains a device identification string using the NDEF (NFC Data Exchange Format) standard that is readable by most NFC-capable reader devices (including smartphones).
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.5.1 NFC HEADER structure The structure of the NFC HEADER area is shown in Table 12 below.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6 ACTIVE CONFIGURATION The ACTIVE CONFIGURATION area contains the currently active configuration settings and PTM 535BZ operates according to the register values in this area. Updating the register values is done via the Configuration Update process as described in Chapter 5.6.16. The structure of ACTIVE CONFIGURATION area is shown in Table 13 below.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER Table 13 – ACTIVE CONFIGURATION structure 5.6.1 INPUT_CONFIG The ECO_DIRECTION field of the INPUT_CONFIG register is used to define which direction of the ECO 200 harvester is considered as a press event and which as a release event.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.2 RADIO_CONFIG The PROTOCOL field of the RADIO_CONFIG register is used to select the protocol. By default, PTM 535BZ will use the BLE radio standard for the transmission of telegrams. ZGP can be selected instead of BLE by setting the PROTOCOL bit is to 0b1. The TX_POWER field of the RADIO_CONFIG register is used to select the radio transmission power. By default, PTM 535BZ will use a transmission power of +4 dBm.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.3 BLE_TX_CONFIG The BLE_TX_CONFIG register is used to configure radio settings that are specific to BLE telegram transmission. The CHANNEL_SELECTION field is used to select the BLE radio channels (as described in Chapter 3.1.2) for the transmission of BLE telegrams. By default, PTM 535BZ will use the three advertising channels (CH37, CH38 and CH39) for the transmission of both data and commissioning telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER The bit fields within the RADIO_CONFIG register are shown in Table 16 below. The default settings are shown in bold.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.4 BLE_SEC_CONFIG The BLE_SEC_CONFIG register is used to configure security settings that are specific to BLE telegram transmission. The BLE_SECURITY_MODE field is intended for future implementation selecting the security mode used by PTM 535BZ when transmitting BLE telegrams. Currently, the supported security mode is using a 32 bit sequence counter to generate a 32 bit CMAC (signature) as described in Chapter 3.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.5 BLE_MANUFACTURER_ID The register MANUFACTURER_ID identifies the manufacturer of the device using the 16 bit company identifier assigned by Bluetooth SIG [6]. The default setting of 0x03DA identifies EnOcean GmbH as the manufacturer of the device. Figure 40 below shows the structure of the BLE_MANUFACTURER_ID register. Figure 40 – BLE_MANUFACTURER_ID register 5.6.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.7 BLE Radio Channel Registers CH1, CH2, CH3 The BLE channel selection registers CH1, CH2 and CH3 define the radio channels used for custom radio transmission sequences as described in Chapter 3.1.2 if use of custom radio transmission sequences is enabled as described in Chapter 5.6.3. If custom radio transmission sequences are enabled, then the radio channels specified in CH1, CH2 and CH3 will be used.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.9 ZGP_TX_CONFIG The ZGP_TX_CONFIG register determines the radio channel used by PTM 535BZ for the transmission of ZGP telegrams. The ZGP_TX_CHANNEL field defines the currently used radio channel (channel 11 … 26) as described in Table 4 of Chapter 4.1. By default, PTM 535BZ uses channel 11 for the transmission of ZGP data telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.10 ZGP_SEC_CONFIG The ZGP_SEC_CONFIG register determines the security mode used by PTM 535BZ for the transmission of ZGP telegrams. The ZGP_SEC_MODE field defines how the security key is encrypted in the commissioning telegram. By default, PTM 535BZ uses the ZA09 key to encrypt the security key. Optionally, PTM 535BZ can use an Install Code (IC) to encrypt the security key.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.11 ZGP_PROTOCOL_CONFIG The ZGP_PROTOCOL_CONFIG register defines the ZGP-specific parameters of PTM 535BZ. The ZGP_DEVICE_ID field selects the DEVICE ID used by PTM 535BZ when transmitting ZGP telegrams. By default, Device ID 0x07 (Generic 8-contact switch) is used as described in Chapter 4.4.1.2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.12 ZGP_SOURCE_ID Each PTM 535BZ module uses a unique four-byte address (ZGP Source ID) to identify itself as the originator of ZGP radio telegrams as described in Chapter 4.4. The ZGP Source ID is assigned by Zigbee Alliance and cannot be changed by the user. For PTM 535BZ devices, the ZGP Source ID has the format 0x015n:nnnn. The structure of the ZGP_SOURCE_ID register is shown in Figure 46 below.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.15 USERn_CONFIGURATION_OPTIONS As described in Chapter 5.1.1, the available configuration options for USER1 are defined in the register USER1_CONFIGURATION_OPTIONS while the available configuration options for USER2 are defined in the register USER2_CONFIGURATION_OPTIONS.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.15.2 ZGP OPTIONS group Table 22 below shows the configuration options belonging to the ZGP OPTIONS configuration group. Four fields in this configuration group are reserved for future use and can therefore not be used by either USER1 or USER2. All other fields in this group can by default be changed both by USER1 and by USER2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.15.4 SYSTEM OPTIONS group Table 24 below shows the configuration options belonging to the SYSTEM OPTIONS configuration group. Four fields in this configuration group are reserved for future use and can therefore not be used by either USER1 or USER2. All other fields in this group can by default be changed both by USER1 and by USER2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.6.17 REQUEST_STATUS The REQUEST_STATUS field informs the user about the status of the most recent NFC configuration update or NFC functional request. Table 25 shows the encoding of the supported status reports.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7 NEW CONFIGURATION The NEW CONFIGURATION area is used to update the configuration parameters used by PTM 535BZ which are stored in the ACTIVE CONFIGURATION area. The structure of NEW CONFIGURATION area is shown in Table 26 below. NFC Page 0x50 0x51 0x52 0x53 0x54 … 0x58 0x59 0x5A 0x5B 0x5C 0x5D … 0x60 0x61 … 0x64 0x65 .. 0x68 … 0x6B 0x6C … 0x6F 0x70 … 0x73 ..
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7.2 REQUEST_TYPE PTM 535BZ supports three different requests (NFC Parameter Update, Commissioning Telegram Transmission and Factory Reset) which can be issued by two users (USER1 and USER2). Request origin (USER1 or USER2) and request type are identified by the REQUEST_ID which is written by the user into the REQUEST_TYPE register. Table 27 below shows the assigned REQUEST_ID values.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER Before requesting an update of the configuration registers, the user should verify that the registers can be changed by him. This is done by checking that the corresponding bits in the USERn_CONFIGURATION_OPTIONS register are set to 0b1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7.3.2 ZGP configuration group Table 29 below shows the configuration options belonging to the ZGP configuration group. Four fields in this configuration group are reserved for future use and can therefore not be used. Note that the ZGP_DECOMMISSIONING_REQUEST field corresponds to a request and cannot be updated.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7.3.4 SYSTEM configuration group Table 31 below shows the configuration options belonging to the SYSTEM configuration group. Four fields in this configuration group are reserved for future use and can therefore not be used. Note that the LRN_TELEGRAM_REQUEST and FACTORY_RESET_REQUEST fields correspond to requests and can therefore not be updated.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7.5 USER1_PIN and USER2_PIN The PIN CODES used to authenticate NFC configuration updates by USER1 or USER2 can – and should - be changed from their default settings.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.7.5.1 USER1_PIN_HASH and USER2_PIN_HASH PTM 535BZ provides 16-bit hash representations of the 32-bit USER1_PIN (called USER1_PIN_HASH) and the 32-bit USER2_PIN (called USER2_PIN_HASH). These hash values allow NFC tools to verify if they possess the correct NFC pin code.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 5.8 Using the NFC interface Using the NFC interface requires a suitable NFC reader. This can be either a USB NFC reader connected to a PC or a suitable smartphone with NFC functionality. The selected reader has to support NFC read and write operations according to the ISO15693 standard.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 6 Mechanical interface PTM 535BZ uses the same mechanical outline as the existing PTM 535 / PTM 535Z / PTM 535J and PTM 535Z products. Existing mechanical designs combining one of the existing variants with an ECO 200 harvester can therefore also be used with PTM 535BZ. Note that PTM 535BZ does not provide meander contacts on board; those have been replaced with the NFC configuration interface.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 7 Application information 7.1 Transmission range The main factors that influence the system transmission range are: - Type and location of the antennas of receiver and transmitter - Type of terrain and degree of obstruction of the link path - Sources of interference affecting the receiver - “Dead spots” caused by signal reflections from nearby conductive objects.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8 Regulatory approvals 8.1 European Union 8.1.1 Declaration of conformity Hereby, EnOcean GmbH, declares that this radio equipment is in compliance with the essential requirements and other relevant provisions of Directive 2014/53/EU. A copy of the Declaration of Conformity can be obtained from the product webpage at www.enocean.com 8.1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8.2 FCC (United States) 8.2.1 Certificate <- To Be Inserted -> © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 535BZ User Manual | v1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8.2.2 Regulatory Statement This device complies with Part 15 of the FCC rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference, and 2. This device must accept any interference received, including interference that may cause undesired operation.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8.3 ISED (former Industry Canada) 8.3.1 Certificate <- To Be Inserted -> © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 535BZ User Manual | v1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8.3.2 Regulatory Statement 8.3.2.1 English version WARNING: Changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. This device complies with Industry Canada license-exempt RSS standard(s). Operation is subject to the following two conditions: 1. This device may not cause interference, and 2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8.3.2.2 French version PRUDENCE: Changements ou modifications pourraient annuler le droit de l'utilisateur à utiliser l'équipement non autorisées. Le présent appareil est conforme aux CNR d’Industrie Canada applicables aux appareils radio exempts de licence. L’exploitation est autorisée aux deux conditions suivantes: 1. L’appareil ne doit pas produire de brouillage, et 2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 535BZ User Manual | v1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 8.4 ARIB (Japan) 8.4.1 ARIB certificate © 2022 EnOcean | www.enocean.com F-710-017, V1.0 PTM 535BZ User Manual | v1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER 9 Product history Table 32 below lists the product history of PTM 535BZ. Revision CA-05 DA-06 Release date January 2021 May 2021 Key changes versus previous revision Product preview (lead customers only) Market release for all customers Table 32 – Product History 10 References [1] ECO 200 Website [2] Bluetooth Core Specification [3] Zigbee Green Power Specification [4] RFC3610 [5] IEEE 802.15.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A. NFC configuration PTM 535BZ can be configured using the integrated NFC interface as described Chapter 5. This appendix provides a set of examples for common configuration tasks using the recommended Elatec NFC reader described in Chapter 5.8.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.1.1 Useful commands The following commands are used when configuring PTM 535BZ using the Elatec NFC reader: SearchTag(maximum ID length) This command is used to search and identify (tag type, tag ID) an NFC tag. This command is used to establish connection to the NFC tag. It has to be issued before any read / write actions.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.1.3 Direct communication with the NFC reader User applications can directly communicate with the Elatec NFC reader via its virtual COM port by issuing request data and parsing the corresponding response data. The Elatec NFC reader uses 9600 baud as baud rate (this is normally detected automatically by the virtual COM port driver).
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.2 Configuration examples This chapter provides examples of common NFC configuration tasks. These examples all follow the same basic configuration sequence as discussed in Chapter 5.7. A.2.1 Configuration sequence This configuration sequence consists of the following steps: 1. Specify the request type and the request originator as defined in Table 27 Register update or functional request, USER1 or USER2 2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.3 Functional Requests PTM 535BZ enables the user to trigger the following functional requests via the NFC interface: Commissioning telegram request Decommissioning telegram request (only when transmitting ZGP data telegrams) Factory reset request These requests are describe in detail in the next chapters. A.3.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.3.1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER PTM 535BZ will evaluate and execute this request upon the next actuation of the ECO 200 harvester as described in Chapter 5.1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.3.3 Factory reset request The NFC configuration parameters of PTM 535BZ can be reset to its factory defaults by factory reset which can be requested via the NFC interface. A.3.3.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4 Configuration requests Configuration requests are used to update the value of one or several NFC configuration registers. A.4.1 Configuration request structure NFC configuration requests have to follow these steps: 1. Connect to NFC tag 2. Identify the request (Configuration request by USER1 or USER2) 3. Authenticate the request (Provide USER1_PIN or USER2_PIN) 4.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.2 Security configuration The security configuration group allows changing the security keys and the authentication PIN codes. A.4.2.1 Changing USER1_PIN USER1_PIN is used to authenticate requests by USER1; it can only be changed by USER1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER USER2_PIN can be changed by USER1 as follows: Command SearchTag(32) ISO15693_WriteSingleBlock(0x0050,0x11 0x00 0x00 0x00) ISO15693_WriteSingleBlock(0x0052,0x02 0x00 0x35 0xE5) ISO15693_WriteSingleBlock(0x0051,0x80 0x00 0x00 0x00) ISO15693_WriteSingleBlock(0x007A,0x12 0x34 0x56 0x78) Description Connect to tag (Search for up to 32 byte ID) Identify request (Configuration request by USER1) Authenticate request (PIN Code
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.2.4 Reading USER2_CONFIGURATION_OPTIONS USER2 can determine the configuration options that are available by reading the USER2_CONFIGURATION_OPTIONS register. This allows identifying configuration options that are not available due to a restriction imposed by USER1 or to handle the case different product revisions where some features are present in one revision only.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.2.5 Restricting USER2_CONFIGURATION_OPTIONS USER1 can restrict the configuration options that are available to USER2. This allows USER1 (for instance an OEM) to pre-configure certain parameters (for instance the radio protocol) and prevent USER2 (for instance an installer) from changing those. To do so, USER1 has to update USER2_CONFIGURATION_OPTIONS with the desired restrictions.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.2.6 Reading SECURITY_KEY1 PTM 535BZ uses different security keys as discussed in Chapter 2.5. SECURITY_KEY1 is used by default; this key can be read and written via the NFC interface.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.2.8 Writing SECURITY_KEY2 SECURITY_KEY2 is initialized to a random value during production; this value can be changed by the user. Factory reset will update SECURITY_KEY2 to a different random value to prevent unauthorized users from determining a security key that was previously used. SECURITY_KEY2 can only be written; it is not possible to read SECURITY_KEY2 via the NFC interface.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.3 ZGP configuration The ZGP configuration group allows defining the radio and protocol parameters related to ZGP data telegrams. A.4.3.1 ZGP radio channel selection PTM 535BZ allows the user to select the ZGP radio channel during the commissioning process using the LRN button as described in Chapter 4.5.2. Alternatively, it is possible to directly select the ZGP radio channel via the NFC interface.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.3.2 ZGP Device ID selection PTM 535BZ allows the user to select the ZGP Device ID used within ZGP data telegrams as discussed in Chapter 4.4.1. By default, PTM 535BZ uses Device ID 0x07 (Generic Switch).
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.4 BLE configuration The BLE configuration group allows changing protocol configuration, the input status encoding and the security key used for the transmission of BLE data telegrams. A.4.4.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.4.2 Security key selection for BLE It is user-selectable which security key (SECURITY_KEY1 or SECURITY_KEY2) should be used to authenticate BLE radio telegrams as described in Chapter 3.4.2 and to generate resolvable private addresses as described in Chapter 3.3.5.2. By default, SECURITY_KEY1 is used.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.5 System configuration The System configuration area allows selecting the radio protocol (BLE or ZGP) used for the telegram transmission. A.4.5.1 Selecting the radio protocol PTM 535BZ uses BLE radio protocol by default.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER A.4.5.2 Changing the input configuration PTM 535BZ allows the user to configure which direction of ECO 200 actuation is considered as “press” and which is consider as “release” for the status encoding in BLE or ZGP data telegrams. As discussed in Chapter 2.4.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER B. Receiver configuration for BLE PTM 535BZ transmits sensor information as a set of advertising events either on the BLE advertising channels or on user-defined radio channels as described in Chapter 3.2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER B.1.1 Advertising interval PTM 535BZ transmits advertising events with an advertising interval of either 20 ms (default setting) or 10 ms (NFC configurable setting). The time required to transmit each advertising telegram within the advertising event is approximately 0.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER B.1.3 Scan interval The scan interval has to be selected such that the receiver will not be inactive so long that it misses all three advertising events.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER C. Parsing of PTM 535BZ BLE radio telegrams This appendix is intended as an example of how start to parse received PTM 535BZ radio telegrams. Please refer to Chapter 3 for a description of the BLE frame structure. C.1 Data telegram example We consider the following raw data telegram data captured from a PTM 535BZ device: D6 BE 89 8E 42 13 06 00 00 10 15 E2 0C FF DA 03 40 00 00 00 01 B0 56 1C 03 89 F4 6E C.1.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER C.2 Commissioning telegram example We consider the following raw commissioning telegram data captured from a PTM 535BZ device: D6 BE 89 8E 42 24 06 00 00 10 15 E2 1D FF DA 03 41 00 00 00 1D 76 A7 A0 DE 93 E7 F5 53 13 2D 58 94 CF F9 9B 06 00 00 10 15 E2 97 B2 B6 C.2.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER D. Authentication of PTM 535BZ BLE data telegrams PTM 535BZ provides the option to authenticate BLE data telegrams as described in Chapter 3.4.2. The authentication mechanism used by PTM 535BZ is standardized as RFC3610 [1]. The following description aims to summarize the security processing steps for users not deeply familiar with cryptography in general or RFC3610 in particular. D.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER D.1.2 Variable input parameters The RFC3610 implementation in PTM 535BZ requires four variable input parameters: Source address The 6 byte source address used to identify the sender of an authenticated message. The source address is required in little endian (least significant byte first) format.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER D.1.3 Obtaining the security key All required parameters except the security key can be directly extracted from the received message that shall be authenticated. The security key – the common secret shared between sender and receiver – has to be obtained via specific mechanisms.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER D.1.5 Constant internal parameters The RFC3610 implementation in PTM 535BZ derives two internal parameters – M’ and L’ – based on the input data and uses them to construct A0_Flag and B_0_Flag which – together with the iteration counter i – are required for subsequent processing. The value of these internal parameters - listed in Table 36 below - is the same for all PTM 535BZ telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER D.2 Algorithm execution sequence The algorithm uses the variable internal parameters A_0, B_0, B_1 together with the private key to generate the authentication vector T_0 using three AES-128 and two XOR operations. The algorithm execution sequence is shown in Figure 60 below. The first four bytes of T_0 are then used to authenticate PTM 535BZ telegrams.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER D.3 Example For this example, we consider the BLE data telegram payload 0CFFDA034000000001B0561C03 received from a PTM 535BZ with source address E21510000006 which is authenticated with security key 1D76A7A0DE93E7F553132D5894CFF99B.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER The execution sequence would then be as follows: X_1 = AES128(B0, Key) X_1 = AES128(490600001015E2400000000000000000, 1D76A7A0DE93E7F553132D5894CFF99B) X_1 = B3B9A7D1B3A1F898D7C8A984AC7A2771 X_1A = XOR(X_1, B_1) X_1A = XOR(B3B9A7D1B3A1F898D7C8A984AC7A2771, 00090CFFDA0340000000010000000000) X_1A = B3B0AB2E69A2B898D7C8A884AC7A2771 X_2 = AES128(X1A, Key) X_2 = AES128(B3B0AB2E69A2B898D7C8A884AC7A2771, 1D76A7A0DE93E7F553132
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER E. Address resolution for resolvable private addresses (RPA) PTM 535BZ provides the option to obfuscate its identity by means of using resolvable private addresses (RPA that are generated using an Identity Resolution Key as described in Chapter 3.3.5.2. This appendix provides an example how to generate and resolve such address. E.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER F. Calulcating the NFC PIN hash As described in Chapter 5.7.5.1, PTM 535BZ provides hash representations of USER1_PIN and USER2_PIN to allow an NFC tool to determine with high likelihood if it possesses the required pin code. This appendix provides two examples how a tool would generate such hash representation and use it to verify if it possesses the correct NFC pin code. F.
USER MANUAL PREVIEW PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER F.2 USER2_PIN_HASH example We consider a PTM 535BZ module with the following 64 bit globally unique NFC ID: NFC_ID = E0022400F340E0D4 PTM 535BZ provides the following USER2_PIN_HASH: USER2_PIN_HASH = 1234 We further consider that a connected NFC tool wants to test if PTM 535BZ uses the default USER1_PIN as described in Chapter 5.1.
