Apricum MECtp-Sec User guide
MECtp
SECURE
MECtp-Sec
KNX Secure Line/Area Coupler/Repeater
Technical & Application Description
MECtp
SECURE
- 2 -
This document is property of the company named at the last page.
Without written approval, it may not be reproduced or commercialized,
distributed or presented to other individuals for commercial purpose.
Details and information contained within may be subject to change
without notice. For the accuracy of the document no warranty is given.
All rights reserved.
MECtp
SECURE
- 3 -
Content
1Product Description 5
1.1 Front Panel 6
1.2 LED Indication 7
1.3 LED Indication of Special Functions 8
1.4 Commissioning 9
1.5 Secure Commissioning 10
1.6 Important Notes 11
1.6.1 Installation and Commissioning 11
1.6.2 Mounting and Safety 11
1.6.3 Maintenance 11
1.7 Safekeeping of Device Certificate 12
1.8 Feature Summary 13
2KNX Secure 14
3Operational Description 15
3.1 TP Secure Coupler Application 15
3.2 TP Secure Repeater Application 16
3.3 KNX Network Installation 17
3.3.1 Individual Address 17
3.3.2 KNX Topology 18
3.4 Adding Device Certificate 19
3.5 Programming 21
3.5.1 Programming of Individual Address (and Application) 21
3.6 Special Functions 22
3.6.1 Manual Function 22
3.6.2 Factory Reset 22
4ETS Database of TP Secure Coupler 23
4.1 General 23
4.2 Main Line 24
4.3 Subline 26
Product Description
MECtp
SECURE
- 5 -
1Product Description
MECtp-Sec, the secured version of MECtp, is a KNX Secure line coupler that supports the
KNX Secure mechanism KNX Data Secure. It provides a bi-directional data connection
between two KNX TP lines. The Device Certificate utilization enables the usage of the
Security function “Secure Commissioning” that can be set to active.
MECtp-Sec can work as Line/Area Coupler to connect KNX TP Lines and KNX TP Areas. It
can also work as KNX Repeater to extend a KNX TP Line. For this purpose, different
applications are available. With using the TP Secure Coupler application, MECtp-Sec serves
as line coupler to connect a TP Line to a TP Area or Backbone (or as area coupler to
connect a TP Area to a TP Backbone). Usage of the TP Secure Repeater application
enables MECtp-Sec to extend a KNX TP Line by providing unfiltered data transfer between
the connected TP Segments. Up to four Segments (each requires a KNX power supply unit)
can form a single TP Line in this way.
MECtp-Sec is suitable for the Extended Frame format and has no KNX communication
objects for itself. Long telegrams are supported with up to 240 bytes APDU length. Filtering
of telegrams can be configured for both Physical Telegrams and Group Telegrams.
Operational modes, line states, telegram traffic, and filter states are shown at the duo-LED
display. Telegram repetition (on both TP sides) is also configurable. For bus traffic reduction,
special repetition/confirmation settings are provided.
It is possible to set programming of MECtp-Sec and main line devices via the subline to
inactive. To be more exact, the sub-to-main transmission of telegrams for configuring
purpose can be switched off. This function can avoid unwanted access to devices (and their
configurations) from a subline (that may be located outside of a building).
The configurable Manual Function for short-time filter switch-off can ease commissioning and
troubleshooting. For example, “transmit all group telegrams” can be activated by a single on-
device button press. After the pre-set time period, MECtp-Sec switches automatically back to
normal operation.
Product Description
MECtp
SECURE
- 6 -
1.1 Front Panel
Figure 1: Front View
Table 1: Front Panel Elements
LEDs
Buttons / Connectors
Bus State KNX TP (Main line)
Function Button
Bus State KNX TP (Subline)
Programming Button
Telegram Traffic KNX TP (Main line)
KNX TP Main Line Connector
Telegram Traffic KNX TP (Subline)
KNX TP Subline Connector
Group Address Routing*
Individual (Physical) Address Routing
Programming LED
*only group telegrams with main groups 0…13
1
A
2
B
3
C
4
D
5
6
7
Product Description
MECtp
SECURE
- 7 -
1.2 LED Indication
Following table gives a general description of the LED display indication intended for normal
operation. Constellations of LED lighting during active special functions are further described
in next chapter.
Table 2: Normal LED Display
Number
LED
Color
Explanation / Range
Bus State KNX TP
(Main line)
green
Main Line OK
orange
Manual Function active
Bus State KNX TP
(Subline)
green
Subline OK
< off >
Subline not connected
Telegram Traffic
KNX TP (Main line)
blinking green
Telegram traffic extent indicated by blinking
blinking red
Transmission error (BUSY, NACK, missing
IACK)
< off >
No telegram traffic
Telegram Traffic
KNX TP (Subline)
blinking green
Telegram traffic extent indicated by blinking
blinking red
Transmission error (BUSY, NACK, missing
IACK)
< off >
No telegram traffic
Group Address
Routing
green
Filter table active
orange
Route all
red
Block all
< off >
Routing of Group Telegrams is different
on main line and subline
Individual
(Physical) Address
Routing
green
Filtering active
orange
Route all
red
Block all
< off >
Routing of Physical telegrams is different
on main line and subline
Programming LED
red
Programming Mode active
< off >
Programming Mode not active
1
2
3
4
5
6
7
Product Description
MECtp
SECURE
- 8 -
1.3 LED Indication of Special Functions
During an active special function, only LEDs described here are lighting. Other LEDs are off.
Table 3: LED Status Display for Manual Function
Number
LED
Color
Comment
Bus State KNX TP
(Main line)
orange
Bus State KNX TP
(Subline)
green
is <off> if not
connected
Group Address
Routing
green:
orange:
red:
filter
route all
block all
Individual Address
Routing
Table 4: LED Status Display for Factory Reset after first Function Button Press
Number
LED
Color
Comment
Bus State KNX TP
(Main line)
orange
Bus State KNX TP
(Subline)
orange
lights red if not
connected
Group Address
Routing
green:
orange:
red:
filter
route all
block all
Individual Address
Routing
1
2
5
6
1
2
5
6
Product Description
MECtp
SECURE
- 9 -
1.4 Commissioning
Please note for commissioning with default settings:
•All telegrams are blocked because the filter table is not defined
•The Manual Function switch-off time is 120 min
•Individual Address is 15.15.0
•Activation of Secure Commissioning requires the Device Certificate
•Activation of Secure Commissioning requires a minimum ETS version
(see also Security functions)
Figure 2: Connection Scheme
To start a secured configuration download, Secure Commissioning must be activated in
the ETS project before. Without activation, MECtp-Sec is working as plain device and
will behave like MECtp (without supporting KNX Secure).
Please also read chapter 1.6 Important Notes before putting the device into operation.
Product Description
MECtp
SECURE
- 10 -
1.5 Secure Commissioning
Before the secured download of a configuration setting and/or the Individual Address can
start, the individual Device Certificate of MECtp-Sec must have been added to the ETS
project. To be able to add it, the ETS project must be password-protected.
A secured download is only possible after activation of Secure Commissioning.
Activation of Secure Commissioning demands the individual Device Certificate.
Device Certificates can only be added to a password-protected ETS project.
When no project password is set, Secure Commissioning cannot be activated. ETS projects
with having Secure Commissioning set to active always require pre-setting a project
password. Having no project password set on activation, the ETS then asks to type it in.
Figure 3: Set Project Password
The individual Device Certificate always is enclosed with a KNX Secure product. To
keep the product fully configurable by the user, it is important to make sure the Device
Certificate cannot be lost (please note chapter 1.7 Safekeeping of Device Certificate).
Product Description
MECtp
SECURE
- 11 -
1.6 Important Notes
It is recommended to participate the standardized courses of a KNX-certified training center
before installing, programming, and commissioning a KNX system. Here, the participant
gains the necessary knowledge and skills, also required for troubleshooting, by practical
exercises.
Please read this chapter carefully before first use and installation:
1.6.1 Installation and Commissioning
•In the case of damage (at storage, transport) no repairs may be carried out by
unauthorized persons
•After connection to the KNX bus system, the device works with its default settings
•Warning: Do not connect to 230 V. The device is supplied by the KNX bus and does not
require any additional external power supply
•The device may only be installed and put into operation by a qualified electrician or
authorized person
•For planning and construction of electric installations the appropriate specifications,
guidelines and regulations in force of the respective country have to be complied
•For configuring, use the ETS (or ETS Inside)
1.6.2 Mounting and Safety
•For mounting use an appropriate equipment according to IEC60715
•Installation on a 35 mm DIN rail (TH35)
•Connect the KNX bus line as for common KNX bus connections with a KNX bus cable, to
be stripped and plugged into a KNX TP connector
•Do not damage electrical insulations during connecting
•Installation only in dry locations
1.6.3 Maintenance
•Accessibility of the device for operation and visual inspection must be provided
•The housing must not be opened
•Protect the device from moisture, dirt and damage
•The device needs no maintenance
•If necessary, the device can be cleaned with a dry cloth
Product Description
MECtp
SECURE
- 12 -
1.7 Safekeeping of Device Certificate
The Device Certificate can be found on a label that is adhered on side of the housing. To
avoid unwanted access, the label consists of two parts. The upper part must remain on the
housing, for identifying the device. The lower one is the tear-off part. This part contains the
Device Certificate and should be removed from the device for keeping the information at a
safe place after commissioning.
Figure 4: Device Certificate Label
After adding the Device Certificate to the Device Certificate list in ETS, the tear-off part of the
Device Certificate label can be archived at a safe place. The Device Certificate list only
needs to contain the certificates of the KNX Secure devices that are used within the ETS
project. ETS then automatically uses the correct certificates for programming the relevant
devices.
For clear identification of the device after removing the tear-off part, the serial number is
printed on both label parts, on the one that was removed and on the fixed one that stays on
the housing.
When the tear-off part that contains the Device Certificate is lost, only the password-
protected ETS project contains the Device Certificate.
Be aware, when the Device Certificate is completely lost, meaning the tear-off part is
unavailable and the project password (that contained the certificate) is lost, too, a
Secure device cannot be set to active secure mode anymore! Consequently, Security
cannot be activated within a new ETS project. In this case, to reprogram a Secure
device with active secure mode, a Reset has to be carried out and the Secure device
can only be used unsecured, as “plain” device, from then.
tear-off part
Product Description
MECtp
SECURE
- 13 -
1.8 Feature Summary
•Device Certificates guarantee only authorized persons can have access to MECtp-Sec.
•When the ETS “Secure Commissioning” function is active, configuration data is
downloaded only in encrypted KNX Data Secure format.
•Configuring MECtp-Sec plus devices on the main line from the subline can be switched off.
(This is very useful, when there are sublines that bear a high risk of being misused.)
•MECtp-Sec supports long telegrams with up to 240 bytes APDU length. (Both product
series, the MEC couplers and UIM interfaces, can process long messages e.g. for energy
metering applications and visualization purposes, and support Extended Frames.)
•Settings to increase data throughput and decrease high bus traffic are featured.
•IACK sending on sent out messages is configurable.
•Repetition is configurable for both Physical Telegrams and Group Telegrams.
•To ease commissioning, troubleshooting and fast on-site diagnostics, normal run-time
filtering can temporarily be suspended by a single the Function button press. Other lines
can be accessed without having to carry out additional ETS downloads. Switching back to
normal run-time filter settings after suspension period expiry is automatic (see Manual
Function). This avoids forgetting to reactivate the settings for normal filtering.
KNX Secure
MECtp
SECURE
- 14 -
2KNX Secure
KNX devices that support KNX Secure are able to use a special protection basing on
telegram encryption. Also, access to the device for configuring is protected and limited to the
user that knows its Device Certificate. The Device Certificate is a device-specific protection
code that is enclosed with the device on delivery.
To make use of the KNX Secure protection, every KNX Secure device supports a secure
mode. When its secure mode is on, commissioning, configuring and runtime communication
run in an encrypted manner so that the device is shielded against intruder attack and
unwanted manipulation. For activation, the Device Certificate is necessary (see chapter 1.5
Secure Commissioning). Only when secure mode is active, the KNX Secure device is able to
read and send encrypted telegrams. When secure mode is off, the Secure device behaves
like a common KNX device without KNX Secure support (also called plain KNX device). KNX
Secure devices in secure mode and plain devices can´t be combined by the same group
object, but it is possible to have a mixed installation consisting of secured devices and plain
devices.
Mixing unsecure and secure communication on the same group address is impossible.
Also, a mix of KNX IP Secure couplers in secure mode and plain KNX IP Secure
couplers cannot be configured when IP Backbone Security is on.
Encrypted KNX telegrams that are processed by secured devices can be distinguished
between telegrams for KNX IP Secure and telegrams for KNX Data Secure:
•KNX IP Secure can only be applied upon the KNX IP medium. KNX Secure telegrams
are sent as encrypted IP Secure frames (no matter if KNX Data Secure is used or not).
•KNX Data Secure can be applied on any KNX communication medium. End-to-end
communication, better say group communication for one or more certain group objects
is encrypted. Due to an individual security key, only end devices having identical
Group Addresses can encrypt/decrypt the telegrams of their secured group.
For programming a KNX Secure device, ETS must know its FDSK (Factory Default Setup
Key) and its serial number. But it is not necessary entering FDSK or serial number. ETS
retrieves this information from the Device Certificate, a device-specific 36-character code
containing both serial number and FDSK. Serial number and FDSK cannot be modified. After
adding a KNX Secure device plus Device Certificate to the ETS project, ETS automatically
sets the project-specific Tool Key that is used for programming from then. This Tool Key
cannot be modified and only be deleted by a device reset (see chapter 3.6.2 Factory Reset).
After the reset, ETS uses the registered FDSK to get access to the device to program a new
Tool Key.
Operational Description
MECtp
SECURE
- 15 -
3Operational Description
In KNX network installations, MECtp-Sec is used as KNX TP line/area coupler to connect two
KNX TP lines. It can be used in plain mode, without activation of Security, and in ETS
projects where Security is set to active. After connecting to KNX TP, MECtp-Sec operates
with its default settings. For KNX TP line/area coupler functionality, only Individual Addresses
x.y.0 can be set. Setting the correct Individual Address is necessary for proper telegram
transmission and functioning within the installation.
3.1 TP Secure Coupler Application
During normal operation, MECtp-Sec reacts in accordance with its filter settings. When
MECtp-Sec receives telegrams that use Individual Addresses as destination (for example
during commissioning), it compares the Individual Address of the receiver with its own
Individual Address and decides on that whether it has to route the telegrams or not. When
MECtp-Sec receives telegrams that use group addresses as destination, only the telegrams
whose group addresses are entered in the filter table are routed.
If a telegram is routed by MECtp-Sec without receiving the corresponding acknowledgement,
i.e. due to a missing receiver or to a transmission error, the telegram will be repeated up to
three times (depending on the ETS setting). With the parameters „Repetitions if errors...“, this
function can be configured separately for each line and both kinds of telegrams. It is
recommended to use the default parameter setting.
If not already configured as Line/Area Coupler, the ETS application program “TP Secure
Coupler” has to be downloaded to the device. Under the Information tab the configuration
setting can be changed by the drop-down menu “Change Application Program”. After
changing the configuration setting the filter table entries can be added manually. Updating
the application program version can also be done here.
Figure 5: TP Secure Coupler Application
Operational Description
MECtp
SECURE
- 16 -
3.2 TP Secure Repeater Application
Any received telegram is routed to all lines irrespective of in which line it is processed. Line
repeaters make no use of a filter table. It is therefore not important whether the telegram is
generated within a line or whether it is sent from an upper line to a lower line via a coupler.
If a telegram is routed by MECtp-Sec without receiving the corresponding acknowledgement,
i.e. due to a missing receiver or to a transmission error, the telegram will be repeated up to
three times (depending on the ETS setting). With the parameters „Repetitions if errors...“, this
function can be configured separately for each line and both kinds of telegrams. It is
recommended to use the default parameter setting.
If not already configured as Line/Area Repeater, the ETS application program “TP Secure
Repeater” has to be downloaded to the device. Under the Information tab the configuration
setting can be changed by the drop-down menu “Change Application Program”. After changing
the configuration setting the filter table entries can be added manually. Updating the application
program version can also be done here.
Figure 6: TP Secure Repeater Application
Operational Description
MECtp
SECURE
- 17 -
3.3 KNX Network Installation
3.3.1 Individual Address
For line coupler functionality in a KNX network, MECtp-Sec has to use the correct Individual
Address of a line coupler (x.y.0). For backbone/area coupler functionality in a KNX network,
MECtp-Sec has to use the correct Individual Address of an area coupler (x.0.0).
It is recommended to make sure the factory default Individual Address 15.15.0 is not
used in the installation network.
Defining a correct topology is absolutely mandatory to guarantee proper functioning.
In a KNX system with MECtp-Sec backbone couplers and MECtp-Sec line couplers, it is
necessary to ensure that MECtp-Sec has an address assigned from a free addressing area.
Following figure illustrates a possible topology scenario.
Figure 7: MECtp-Sec Network Topology
Example: If a KNX line coupler with address 1.0.0 exists on the backbone no KNX line
coupler with address 1.x.0 can be added here. Even if no line coupler with address 1.1.0
exists on the subline of the 1.0.0 coupler. Vice versa, when line couplers with addresses
3.x.0 already exist in an installation, a line coupler with address 3.0.0 cannot be added.
Operational Description
MECtp
SECURE
- 18 -
3.3.2 KNX Topology
Via a line/area coupler up to 15 lines can be connected to a main line called an area. It is
possible to have up to 64 bus devices on one line. With use of line repeaters a line can
theoretically be extended to 255 bus devices. This means up to four line segments form a
single KNX TP line. But it is common practice on exceeding 64 bus devices to insert a new
line instead of extending the originating one.
The free tree structure of the KNX topology prevents problems caused by circling telegrams
and heavy bus load. To maintain this condition, interconnection between lines or line
segments is strictly forbidden.
Figure 8: MECtp-Sec Network Topology
Each line segment requires its own KNX power supply unit.
Using repeaters on backbone and main lines is not allowed.
Interconnections are not allowed.
Operational Description
MECtp
SECURE
- 19 -
3.4 Adding Device Certificate
The Device Certificate can be found printed on a side label on the housing. Every KNX
Secure device uses its own Device Certificate. Entering this Device Certificate in ETS is
mandatory before activating or using KNX Security functions.
Please also follow the advice on handling the tear-off part of the side label in chapter
1.7 Safekeeping of Device Certificate.
The Device Certificate can be entered manually and by taking a webcam picture of the QR
code that is additionally contained on the tear-off part of the Device Certificate side label.
Figure 9: Tear-off Part of the Device Certificate Side Label
After opening the project, the Device Certificate list can be edited. In the Security tab under
Project Overview Device Certificates can be added and deleted.
Figure 10: Device Certificate List
When the Device Certificate list doesn´t contain the Device Certificate of a certain Secure
device, on starting the Secure download into this device following window appears. Then, the
QR code must be scanned, or alternatively, the 36-character code of the Device Certificate
must be entered manually to continue.
Operational Description
MECtp
SECURE
- 20 -
Figure 11: Adding Device Certificate
Table of contents
