Page 2
® The Bluetooth word mark and logos are registered trademarks owned by the Bluetooth SIG, Inc. and any use of such marks by EnOcean GmbH is under license. Other trademarks and trade names are those of their respective owners. Important! This information describes the type of component and shall not be considered as assured characteristics.
Page 4
7.3.1 Example for a product QR code ..............55 PTM 215B device label ................. 56 PTM 215B device label for products up to version DB-05 ........56 8.1.1 Commissioning DMC structure ..............57 PTM 215B device label for products starting with version DC-06 ......58 8.2.1 QR Code format ..................
Figure 2 – Electro-dynamic powered pushbutton transmitter module PTM 215B Basic Functionality PTM 215B devices contain an electro-dynamic energy converter which is actuated by an energy bow (1). This bow is pushed by an appropriate push button, switch rocker or a simi- lar construction mounted onto the device.
PUSHBUTTON TRANSMITTER MODULE User Interface PTM 215B devices provide four button contacts. They are grouped into two channels (Channel A and Channel B) each containing two button contacts (State O and State I). The state of all four button contacts (pressed or not pressed) is transmitted together with a unique device identification (48 Bit device ID) whenever the energy bow is pushed or re- leased.
PTM 215B transmits Bluetooth Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz … 2480MHz). By default, PTM 215B will use the three BLE advertising channels (BLE Channel 37, 38 and 39) defined for transmission. The transmission of a radio telegram on these three advertis- ing channels is called an Advertising Event.
In certain situations it might be desirable to transmit radio telegrams on channels other than the three advertising channels. PTM 215B therefore allows to select the radio channels to be used for the transmission of data telegrams and commissioning telegrams. The following transmission modes are sup-...
TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3. The PTM 215B telegram will in this mode be transmitted on the radio channel selected by TX_CHANNEL1 first, immediately followed by a transmission on the radio channel selected by TX_CHANNEL2 and a transmission on the radio channel selected by TX_CHANNEL3.
(selected by TX_CHANNEL2 and TX_CHANNEL3 respectively), i.e. all trans- missions will be on the radio channel selected by TX_CHANNEL1. The PTM 215B telegram will be sent six times on this radio channel as shown in Figure 8 below.
® PUSHBUTTON TRANSMITTER MODULE 4. Telegram format PTM 215B transmits Bluetooth Low Energy (BLE) radio telegrams in the 2.4 GHz band. For detailed information about the Bluetooth Low Energy standard, please refer to the applica- ble specifications. Figure 9 below summarizes the BLE frame structure.
These two address modes are described in the following chapters. 4.4.1 Static source address mode By default, PTM 215B uses static source addresses meaning that the source address is con- stant during normal operation. The static source address can be read and configured (writ- ten) via NFC as described in chapter 6.
PTM 215B) to do so. The shared security key – which has to be known by both PTM 215B and the authorized receiver – is called the Identity Resolution Key (IRK). PTM 215B uses its device-unique ran- dom key as identity resolution key.
0x0E / 0x10) respectively Type (1 byte) The Type field identifies the data type used for this telegram. For PTM 215B data telegrams, this field is always set to 0xFF to designate manufacturer-specific data field Manufacturer ID (2 byte) ...
3. Calculate data payload 4. Calculate security signature In PTM 215B, the type of action (Press Action or Release Action) is indicated by Bit 0 (Ener- gy Bar). If a button contact has been actuated during Press Action or Release Action then this is indicated by the according status bit set to ‘1’.
Length (1 byte) The Length field specifies the combined length of the following fields. For PTM 215B commissioning telegrams, this field is set to 0x1D to indicate 29 byte of manufactur- er-specific data. Note: In product versions prior to DC-06 this field was incorrectly set to 0x1E.
In order to avoid message replay (capture and retransmission of a valid message), it is required that the receiver tracks the value of the sequence counter used by PTM 215B and only accepts messages with higher sequence counter values (i.e. not accepts equal or lower sequence counter values for subsequent telegrams).
® PUSHBUTTON TRANSMITTER MODULE 4.7.1 Authentication implementation PTM 215B implements data telegram authentication based on AES128 in CCM (Counter with CBC-MAC) mode as described in IETF RFC3610. At the time of writing, the RFC3610 stand- ard could be found here: https://www.ietf.org/rfc/rfc3610.txt...
The receiver needs to know how to uniquely identify this specific PTM 215B device. This is achieved by using a unique 48 Bit ID (Source Address) for each PTM 215B device as described in chapter 4.4. In addition, up to 4 byte of Optional Data can be configured as described in chapter 6.7.8...
PTM 215B configuration using the default PIN code. Should you lose the new NFC PIN code then PTM 215B can be reset to factory mode (with the default NFC PIN code) by means of a factory reset as described in chapter 5.4.
For cases where both NFC and camera-based commissioning are not feasible it is possible to set PTM 215B into a specific mode where it transmits commissioning telegrams. This functionality can be disabled via the NFC configuration interface by setting the DISABLE LRN TELEGRAM flag in the Configuration register to 0b1 (see chapter 6.7.3).
PUSHBUTTON TRANSMITTER MODULE To enter commissioning mode, start by selecting one button contact of PTM 215B. Any but- ton of PTM 215B (A0, A1, B0, B1) can be used. This button is referred to as Button_X in Figure 20 above.
PTM 215B can be reset to its default settings by means of a factory reset. This ensures that PTM 215B can be reset to a known configuration in case the PIN for the NFC access has been lost or NFC access is not possible for other reasons In order to execute such factory reset, the rocker(s) and the switch housing have to be removed from the PTM 215B module.
14443 Part 2 and 3 standards using an NXP NT3H2111 Mifare Ultralight tag. This NFC functionality can be used to access (read and write) the PTM 215B configuration memory and thereby configure the device as described in the following chapters.
Protected data In addition to that, PTM 215B maintains a private configuration memory region used to store default parameters and confidential information which is not accessible to the user. Figure 29 below shows the configuration memory structure used by PTM 215B.
This is a 4 byte field containing the four least significant bytes (the two most signifi- cant bytes are always 0xE215) of the static source address used by PTM 215B, see chapter 4.4.1. Each PTM 215B is pre-programmed with an individual static source address.
This 4 byte register is used to update the Manufacturer ID, see chapter 6.7.7 Security Key Write register This 16 byte register is used to update the security key used by PTM 215B, see chapter 6.7.5 Optional Data register ...
Write) in the protected data area and set the according Update flag in the Configuration register. After that, the user has to push and release the energy bar of the PTM 215B module. 6.7.3 Configuration register The Configuration register is 1 byte wide and contains configuration flags. Figure 30 below shows the structure of the Configuration register.
The Source Address Write register is 4 byte wide and can be used to modify the lower 32 bit of the PTM 215B Static Source Address. The upper 16 bit of the PTM 215B Static Source Address are always fixed to 0xE215 to identify the device type. In order to do change the lower 32 bit of the Static Source Address, follow these steps: 1.
If the size of the OPTIONAL DATA SIZE field is set to a non-zero value in the Configuration register then PTM 215B will read the corresponding amount of data from the Optional Data register beginning with the least significant byte (Byte 0 – Optional Data 0).
6.7.11 Customer Data PTM 215B allocates 64 pages (256 byte) for customer data that can be read and written via the NFC interface in protected mode. The main intention is to enable storing OEM-specific information such as product type, revi- sion, date code or similar.
The content of the private data area is not externally accessible. 6.8.1 Security Key The Security Key field contains the 128 bit private key used for authenticating PTM 215B telegrams and for resolving private source addresses. This register is programmed with a random value during manufacturing. It can be changed using the Security Key Write feature described in chapter 6.7.5.
PUSHBUTTON TRANSMITTER MODULE 7. Device integration PTM 215B is designed for integration into button or rocker based switches. It implements the established PTM 2xx mechanical form factor and can therefore be used with a wide va- riety of existing designs.
Page 53
2) dimensions of rocker part Figure 37 – PTM 215B, side view If the rocker is not mounted on the rotation axis of PTM 215B several tolerances have to be considered! The measure from support plane to top of the energy bow is 7.70 mm +/- 0.3 mm!
Page 54
PTM 215B is powered by the electromagnetic generator ECO 200. For proper func- tion magnets or ferromagnetic materials are not permitted within a keep-out zone of 60mm around the center of PTM 215B.
PUSHBUTTON TRANSMITTER MODULE Product label Customer products integrating PTM 215B modules should include a QR code on their prod- uct label for the purpose of commissioning as described in chapter 5.2. This QR code can then be scanned by commissioning tools to automatically extract the required product pa- rameters.
Each PTM 215B module contains a device label. Note that the finished switches (EWSSB, EWSDB, ESRPB and EDRPB) use a different product label as described in their user manuals and the information given in the subsequent chapters applies only to the PTM 215B module itself.
128 bit device-unique random security key (different for each device) Figure 40 below shows the Commissioning DMC from the label in Figure 39. Figure 40 – Commissioning DMC (for PTM 215B versions up to DB-05) The Commissioning DMC shown above encodes the following string: PTM215BIDE21501500100OOB0123456789ABCDEF0123456789ABCDEF...
PUSHBUTTON TRANSMITTER MODULE PTM 215B device label for products starting with version DC-06 PTM 215B products starting with version DC–06 (PTM 215B produced after May 2018) use a new label as shown in Figure 41 below. Figure 41 – PTM 215B device label (for versions starting with DC-06) This label adds the required ARIB (Japan) certification logo and ID (206-000585) and merges the two DMC used previously into one QR code.
(for how long will the receiver scan within each scanning cycle). PTM 215B transmits the advertising events with a pause interval of 20 ms between two transmissions. The transmission of the advertising event itself requires approximately 1 ms...
® PUSHBUTTON TRANSMITTER MODULE 10. Regulatory information PTM 215B has been certified according to FCC (US), ISED (CA) and RED (EU) regulations. Changes or modifications not expressly approved by EnOcean could void the user's authori- ty to operate the equipment.
PUSHBUTTON TRANSMITTER MODULE A. Parsing PTM 215B radio telegrams This appendix is intended as an example of how start to parse received PTM 215B radio telegrams. Please refer to chapter 4 first for a description of the BLE frame structure...
PUSHBUTTON TRANSMITTER MODULE B. Address resolution for resolvable private addresses (RPA) PTM 215B provides the option to obfuscate its identity by means of using resolvable private addresses (RPA) as described in chapter 4.4.2. The following chapters describe how to re- solve such addresses.
PUSHBUTTON TRANSMITTER MODULE B.1.2 Address resolution example We consider a PTM 215B device with the following IRK (options for determining the IRK / security key of a PTM 215B are described in chapter C.1.3.): BE759A027A4870FD242794F4C45220FB We further consider a telegram having the following resolvable private address: 493970E51944 We will now test if this resolvable private address was generated using the IRK above.
RFC3610 in particular. Algorithm input parameters The purpose of the security processing in PTM 215B is to calculate a unique signature that can be used to verify authenticity (telegram has not been modified) and originality (tele- gram comes from the assumed sender) of a telegram.
The sequence counter is transmitted as part of the input data. The receiver of PTM 215B telegrams keeps track of this counter and will accept only telegrams with counter values higher than the highest previously used value. This eliminates the possibility of reusing previously transmitted telegrams.
PUSHBUTTON TRANSMITTER MODULE C.1.3.2 Obtaining the security key via the product DMC code Each PTM 215B module contains a DMC code on its product label which identifies source address and security key of the module, see chapter 5.2. The DMC code of the device used for this tutorial encoded in the DMC code format up to revision DB-05 is shown in Figure 43 below.
3DDA31AD44767AE3CE56DCE2B3CE2ABB C.1.4 Internal parameters The RFC3610 implementation in PTM 215B derives a set of internal parameters for further processing from the provided input parameters. Again, there are two types of internal parameters: Constant internal parameters ...
C.1.5 Constant internal parameters The RFC3610 implementation in PTM 215B derives two internal parameters – M’ and L’ – based on the input data and uses them to construct A0_Flag and B_0_Flag which – togeth- er with the iteration counter i – are required for subsequent processing.
C.3.1 Data telegram without optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0C FF DA 03 5D 04 00 00 11 B2 FA 88 FF...
C.3.2 Data telegram with 1 byte optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0D FF DA 03 62 04 00 00 10 12 B9 FE AC C1 The last four bytes of this payload (B9 FE AC C1) are the sender-provided signature which has to be authenticated.
C.3.3 Data telegram with 2 byte optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0E FF DA 03 63 04 00 00 11 12 34 52 E0 51 16 The last four bytes of this payload (52 E0 51 16) are the sender-provided signature which has to be authenticated.
C.3.4 Data telegram with 4 byte optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 10 FF DA 03 6A 04 00 00 10 12 34 56 78 2C 9E 10 95 The last four bytes of this payload (2C 9E 10 95) are the sender-provided signature which has to be authenticated.
Need help?
Do you have a question about the PTM 215B and is the answer not in the manual?
Questions and answers