EnOcean EASYFIT ESRPB User manual
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 1/68
Patent protected:
WO98/36395, DE 100 25 561, DE 101 50 128,
WO 2004/051591, DE 103 01 678 A1, DE 10309334,
WO 04/109236, WO 05/096482, WO 02/095707,
US 6,747,573, US 7,019,241
Observe precautions! Electrostatic sensitive devices!
ESRPB / EDRPB
EASYFIT Bluetooth® Single / Double Rocker Pad
09.01.2018
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 2/68
REVISION HISTORY
The following major modifications and improvements have been made to this document:
Version
Author
Reviewer
Date
Major Changes
1.0
MKA
MKA
22.02.2017
Initial Release
1.1
MKA
MKA
30.03.2017
Added step by step payload parsing ex-
ample
1.2
MKA
MKA
30.06.2017
Added product label information
1.3
MKA
MKA
09.01.2018
Added Australia approval
Published by EnOcean GmbH, Kolpingring 18a, 82041 Oberhaching, Germany
www.enocean.com, info@enocean.com, phone +49 (89) 6734 6890
© EnOcean GmbH, All Rights Reserved
Important!
This information describes the type of component and shall not be considered as assured
characteristics. No responsibility is assumed for possible omissions or inaccuracies. Circuitry
and specifications are subject to change without notice. For the latest product specifica-
tions, refer to the EnOcean website: http://www.enocean.com.
As far as patents or other rights of third parties are concerned, liability is only assumed for
modules, not for the described applications, processes and circuits.
EnOcean does not assume responsibility for use of modules described and limits its liability
to the replacement of modules determined to be defective due to workmanship. Devices or
systems containing RF components must meet the essential requirements of the local legal
authorities.
The modules must not be used in any relation with equipment that supports, directly or
indirectly, human health or life or with applications that can result in danger for people,
animals or real value.
Components of the modules are considered and should be disposed of as hazardous waste.
Local government regulations are to be observed.
Packing: Please use the recycling operators known to you.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 3/68
TABLE OF CONTENT
1GENERAL DESCRIPTION .................................................................................6
1.1 Basic functionality ......................................................................................... 6
1.2 Ordering information......................................................................................6
1.3 Technical data............................................................................................... 7
1.4 Physical dimensions and mounting options ....................................................... 7
1.5 Environmental conditions ...............................................................................7
1.6 Packaging information.................................................................................... 7
2FUNCTIONAL INFORMATION ...........................................................................8
2.1 Product Overview ..........................................................................................8
3Telegram transmission ...................................................................................9
3.1 Radio channel parameters ..............................................................................9
3.2 Default radio transmission sequence .............................................................. 10
3.3 User-defined radio transmission sequences..................................................... 10
3.3.1 Three channel sequence ....................................................................... 11
3.3.2 Two channel sequence.......................................................................... 12
3.3.3 Single channel sequence....................................................................... 12
4Telegram format ......................................................................................... 13
4.1 Preamble.................................................................................................... 13
4.2 Access Address ........................................................................................... 13
4.3 Header....................................................................................................... 13
4.4 Source address ........................................................................................... 14
4.4.1 Static source address mode .................................................................. 14
4.4.2 Private resolvable source address mode ................................................. 15
4.5 Check Sum................................................................................................. 16
4.6 Payload...................................................................................................... 17
4.7 Switch status encoding................................................................................. 18
4.8 ExRPB telegram authentication ..................................................................... 19
4.8.1 Authentication implementation .............................................................. 20
5ExRPB commissioning .................................................................................. 21
5.1 NFC-based commissioning ............................................................................ 22
5.2 Camera-based commissioning via QR code ..................................................... 23
5.2.1 QR code format ................................................................................... 23
5.3 Radio-based commissioning.......................................................................... 24
5.3.1 Commissioning mode entry................................................................... 24
5.3.2 Commissioning telegram transmission.................................................... 25
5.3.3 Exit from commissioning mode .............................................................. 26
5.4 Factory Reset.............................................................................................. 26
6NFC interface.............................................................................................. 27
6.1 Using the NFC interface................................................................................ 27
6.2 NFC interface functions ................................................................................ 28
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 4/68
6.2.1 NFC interface state machine.................................................................. 28
6.2.2 IDLE state........................................................................................... 29
6.2.3 READY 1 state ..................................................................................... 29
6.2.4 READY 2 state ..................................................................................... 29
6.2.5 ACTIVE state....................................................................................... 29
6.2.6 Read command ................................................................................... 30
6.2.7 Write command ................................................................................... 30
6.2.8 Password authentication (PWD_AUTH) command..................................... 31
6.3 Using TWN4 as USB NFC reader .................................................................... 32
6.3.1 Useful commands ................................................................................ 33
6.3.2 Translation into binary data .................................................................. 33
6.4 Configuration memory organization ............................................................... 34
6.5 Memory Address Map................................................................................... 35
6.6 Public data ................................................................................................. 36
6.7 Protected Data ............................................................................................ 37
6.7.1 PIN Code ............................................................................................ 38
6.7.1 Configuration of product parameters ...................................................... 38
6.7.2 Source Address Write register ............................................................... 38
6.7.3 Security Key Write register ................................................................... 39
6.7.4 Product ID and Manufacturer ID Write register ........................................ 40
6.7.5 Optional Data register .......................................................................... 40
6.7.6 Configuration register........................................................................... 41
6.7.7 Custom Channel Mode register .............................................................. 42
6.7.8 Radio Channel Selection registers .......................................................... 43
6.7.9 Customer Data .................................................................................... 44
6.8 Private Data................................................................................................ 45
6.8.1 Security Key ....................................................................................... 45
6.8.2 Default Settings................................................................................... 45
7Device Label ............................................................................................... 46
8APPLICATION INFORMATION ........................................................................ 47
8.1 Transmission range ..................................................................................... 47
8.2 External magnets ........................................................................................ 47
8.3 Receiver configuration.................................................................................. 48
9REGULATORY INFORMATION......................................................................... 49
9.1 CE / RE-D for Europe Union .......................................................................... 49
9.2 FCC (United States) Certificate...................................................................... 50
9.2.1 FCC (United States) Regulatory Statement.............................................. 51
9.3 IC (Industry Canada) Certificate.................................................................... 52
9.3.1 IC (Industry Canada) Regulatory Statement............................................ 53
9.4 ACMA (Australia) Declaration of Conformity .................................................... 54
AParsing ESRPB / EDRPB radio telegrams ......................................................... 56
A.1 Data telegram example ................................................................................ 56
A.1.1 BLE frame structure................................................................................. 56
A.1.2 EnOcean data telegram payload structure................................................... 56
A.2 Commissioning telegram example ................................................................. 57
A.2.1 BLE frame structure................................................................................. 57
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 5/68
A.2.2 EnOcean commissioning telegram payload structure .................................... 57
BAuthentication of ESRPB / EDRPB data telegrams ............................................ 58
B.1 Algorithm input parameters .......................................................................... 58
B.1.1 Constant input parameters ....................................................................... 58
B.1.2 Variable input parameters ........................................................................ 59
B.1.3 Obtaining the security key ........................................................................ 60
B.1.3.1 Obtaining the security key via NFC interface......................................... 60
B.1.3.2 Obtaining the security key via the product DMC code ............................ 61
B.1.3.3 Obtaining the security key via a commissioning telegram ....................... 61
B.2 Internal parameters..................................................................................... 62
B.3 Constant internal parameters........................................................................ 62
B.4 Variable internal parameters......................................................................... 63
B.5 Algorithm execution sequence....................................................................... 63
B.6 Examples ................................................................................................... 64
B.6.1 Data telegram without optional data .......................................................... 64
B.6.2 Data telegram with 1 byte optional data..................................................... 66
B.6.3 Data telegram with 2 byte optional data..................................................... 67
B.6.4 Data telegram with 4 byte optional data..................................................... 68
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 6/68
1GENERAL DESCRIPTION
1.1 Basic functionality
EnOcean Easyfit Bluetooth® Single / Double Rocker Pad (ESRPB / EDRPB, jointly referred
to as ExRPB ) are universal energy harvesting wireless switches in the US rocker pad form
factor for systems using the 2.4 GHz Bluetooth Low Energy (BLE) radio standard.
ESRPB and EDRPB are based on the maintenance free, self-powered Bluetooth pushbutton
transmitter module PTM 215B.
PTM 215B contains an electro-dynamic energy transducer which is actuated by the ExRPB
rocker movement. Whenever a rocker is pushed down or released, electrical energy is cre-
ated and a set of Bluetooth advertising frames is transmitted by the PTM 215B radio trans-
mitter which identifies the rocker status (pushed or released).
ExRPB radio telegrams are protected with AES-128 security based on a device-unique pri-
vate key.
„Long“ or „Short“ rocker press (the time between pushing and releasing the rocker) can be
calculated by the receiver. This enables switching, dimming control or jalousie control in-
cluding slat action
Figure 1 below shows the single rocker (ESRPB) and double rocker (EDRPB) product vari-
ants.
Figure 1 –ESRPB (single rocker) and EDRPB (double rocker) variants
1.2 Ordering information
Type
Ordering Code
ESRPB
ESRPB-W-EO
EDRPB
EDRPB-W-EO
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 7/68
1.3 Technical data
Antenna
Integrated PCB antenna
Output Power
0 dBm
Communication Range (Guidance Only)
75 m ideal line of sight / 10 m indoor environment
Communication Standard
Bluetooth Low Energy (Advertising)
Radio Frequency (min / max)
2402 MHz / 2480 MHz
Default Radio Channels
BLE CH 37 / 38 / 39 (2402 MHz / 2426 MHz / 2480 MHz)
Advertising Events per press or release
(min / max)
2 / 3
Data Rate and Modulation
1 Mbit/s GFSK
Configuration Interface
NFC Forum Type 2 Tag (ISO/IEC 14443 Part 2 and 3)
Device Identification
Unique 48 Bit Device ID (factory programmed)
Security
AES128 (CBC Mode) with Sequence Code
Power Supply
Integrated Kinetic Energy Harvester
Inputs
Single (ESRPB) or Double Rocker (EDRPB)
1.4 Physical dimensions and mounting options
Dimensions of Single Rocker Pad
4.95” H x 3.21” W x 0.74” D (126mm x 82mm x 19mm)
Dimensions of Double Rocker Pad
4.95” H x 4.52” W x 0.72” D (126mm x 115mm x 18mm)
Weight of Single Rocker Pad
3.9 oz (112g)
Weight of Double Rocker Pad
5.3 oz (150g)
Mounting
Screwing onto flat surface (screws enclosed)
1.5 Environmental conditions
Operating Temperature
-25°C ... 65°C
Storage Temperature
-25°C ... 65°C
Humidity
0% to 95% r.h. (non-condensing)
1.6 Packaging information
Packaging Unit 24 units
Packaging Method Each unit packed in a box, 24 units packed in a case
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 8/68
2FUNCTIONAL INFORMATION
2.1 Product Overview
Easyfit Bluetooth Single (EDRPB) and Double (EDRPB) Rocker Pad from EnOcean enable the
implementation of wireless switches in the US rocker pad form factor without batteries.
ESRPB and EDRPB are based on the PTM 215B energy harvesting wireless pushbutton
module which is shown in Figure 2 below.
Figure 2 –PTM 215B module
Power is provided by an electro-dynamic energy generator that is built into the PTM 215B
module and enables radio transmissions using the 2.4GHz Bluetooth Low Energy (BLE)
standard.
The PTM 215B module provides four button contacts which are actuated by one (single)
rocker (ESRPB) or two (double) rockers (EDRPB). The button contacts of the PTM 215B
module are grouped into two channels (Channel A and Channel B) with each channel con-
taining two button contacts (State O and State I).
For the double rocker variant EDRPB, each channel is actuated by one of the two rockers.
In case of the single rocker variant ESRPB, only channel B is actuated by the single rocker.
The state of all four button contacts (pressed or not pressed) is transmitted together with a
unique device identification (48 bit source address) whenever a rocker is pushed or re-
leased.
Figure 3 below shows the arrangement of the four button contacts on the PTM 215B module
and their designation.
Figure 3 –Button contact designation of the PTM 215B module
O
I
BA
CHANNEL
STATE
O
I
BA
CHANNEL
STATE
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 9/68
3Telegram transmission
3.1 Radio channel parameters
ExRPB transmits advertising telegrams within the 2.4 GHz radio frequency band (2402MHz
… 2480MHz) using the Bluetooth Low Energy (BLE) advertising frame format.
By default, ExRPB will use the three BLE advertising channels (BLE Channel 37, 38 and 39)
defined for transmission. The transmission of a radio telegram on these three advertising
channels is called an Advertising Event.
Use of different radio channels within the frequency band from 2402 MHz to 2480 MHz is
possible, see chapter 6.7.8.
The initialization value for data whitening is set as follows:
For BLE channels is set according to specification (value = radio channel)
For the custom radio channels the initialization value is equal to the offset from
2400 MHz (e.g. value = 3 for 2403 MHz)
Table 1 below summarizes radio channels supported by ExRPB.
Radio Channel
Frequency
Channel Type
BLE Radio Channels
37
2402 MHz
BLE Advertising Channel
0
2404 MHz
BLE Data Channel
1
2406 MHz
BLE Data Channel
…
10
2424 MHz
BLE Data Channel
38
2426 MHz
BLE Advertising Channel
11
2428 MHz
BLE Data Channel
12
2430 MHz
BLE Data Channel
…
36
2478 MHz
BLE Data Channel
39
2480 MHz
BLE Advertising Channel
Custom Radio Channels
40
2403 MHz
Custom Radio Channel
41
2405 MHz
Custom Radio Channel
…
77
2477 MHz
Custom Radio Channel
78
2479 MHz
Custom Radio Channel
Table 1 –ExRPB supported radio channels
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 10/68
3.2 Default radio transmission sequence
ExRPB transmits telegrams in its standard configuration by using so-called Advertising
Events.
An advertising event is defined as the transmission of the same radio telegram on all se-
lected radio channels (by default this would be on BLE Channel 37, 38 and 39) one after
another with minimum delay in between.
For reliability reasons, ExRPB will send several (minimum two, maximum three) advertising
events for each button input. The resulting transmission sequence is shown in Figure 4 be-
low.
Figure 4 –Default radio transmission sequence
3.3 User-defined radio transmission sequences
In certain situations it might be desirable to transmit radio telegrams on channels other
than the three advertising channels.
ExRPB therefore allows to select the radio channels to be used for the transmission of data
telegrams and commissioning telegrams. The following transmission modes are supported:
Both commissioning telegrams and data telegrams are transmitted on the advertis-
ing channels as three advertising events. This is the default configuration and de-
scribed in chapter 3.2 above.
Commissioning telegrams are transmitted on the advertising channels as three ad-
vertising events while data telegrams are transmitted in a user-defined sequence as
described below.
Both commissioning and data telegrams are transmitted in a user-defined sequence
as described below.
The selection of the transmission mode is done using the CUSTOM CHANNEL MODE register of
the NFC configuration interface as described in chapter 6.7.7.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 11/68
ExRPB supports the following user-defined sequences:
Three channel sequence
This sequence is similar to the default Advertising Event with the difference that the
user can select the radio channels to be used. The three channel sequence is de-
scribed in chapter 3.3.1 below.
Two channel sequence
In this sequence the radio telegram is transmitted using four transmissions on two
radio channels. It is described in chapter 3.3.2 below.
One channel sequence
In this sequence the radio telegram is transmitted using six transmissions on one
radio channel. It is described in chapter 3.3.3 below.
3.3.1 Three channel sequence
The three channel radio transmission sequence is similar to the default transmission se-
quence. The difference is that the radio channels (BLE Channel 37, 38 and 39 in the default
transmission sequence) can be selected using the Radio Channel Selection registers
CH_REG1, CH_REG2 and CH_REG3.
The ExRPB advertising telegram will in this mode be transmitted on the radio channel se-
lected by CH_REG1 first, immediately followed by a transmission on the radio channel select-
ed by CH_REG2 and a transmission on the radio channel selected by CH_REG3.
This transmission sequence will be sent three times in total with pauses of 20 ms in be-
tween as shown in Figure 5 below.
Figure 5 –Three channel radio transmission sequence
The format of CH_REG1, CH_REG2 and CH_REG3 is described in chapter 6.7.8.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 12/68
3.3.2 Two channel sequence
The two channel radio transmission sequence removes transmission on the third radio
channel (selected by CH_REG3) and instead repeats the transmission once more (four times
in total).
The ExRPB advertising telegram will in this mode be transmitted on the radio channel se-
lected by CH_REG1 first, immediately followed by a transmission on the radio channel select-
ed by CH_REG2.
This transmission sequence will be sent four times in total with pauses of 20 ms in between
as shown in Figure 6 below.
Figure 6 –Two channel radio transmission sequence
The format of CH_REG1 and CH_REG2 is described in chapter 6.7.8.
3.3.3 Single channel sequence
The single channel radio transmission sequence removes transmission on the second and
third radio channel (selected by CH_REG2 and CH_REG3 respectively), i.e. all transmissions
will be on the radio channel selected by CH_REG1.
The ExRPB advertising telegram will be sent six times on this radio channel with pauses of
20 ms in between as shown in Figure 7 below.
Figure 7 –Single channel radio transmission sequence
The format of CH_REG1 is described in chapter 6.7.8.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 13/68
4Telegram format
ExRPB transmits radio telegrams in the 2.4 GHz band according to BLE frame structure. For
detailed information about the BLE standard, please refer to the applicable specifications.
Figure 8 below summarizes the BLE frame structure.
Figure 8 –BLE frame structure
The content of these fields is described in more detail below.
4.1 Preamble
The BLE Preamble is 1 byte long and identifies the start of the BLE frame. The value of the
BLE Preamble is always set to 0xAA.
4.2 Access Address
The 4 byte BLE Access Address identifies the radio telegram type. For advertising frames,
the value of the Access Address is always set to 0x8E89BED6.
4.3 Header
The BLE Header identifies certain radio telegram parameters. Figure 9 below shows the
structure of the BLE header.
Figure 9 –BLE header structure
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 14/68
4.4 Source address
The 6 byte BLE Source Address (MAC address) uniquely identifies each ExRPB product.
ExRPB supports two source address modes:
Static Source Address mode (default)
In this mode, the source address is constant (but its lower 32 bit can be configured
via NFC interface)
Private Resolvable Address mode (NFC configurable)
In this mode, the source address changes for each transmission
ExRPB uses by default Static Source Address mode.
Private Resolvable Address mode can be selected by setting the Private Source Address
flag in the Configuration register (see chapter 6.7.6) to 0b0.
These two address modes are described in the following chapters.
4.4.1 Static source address mode
By default, ExRPB uses static source addresses meaning that the source address is constant
during normal operation. The static source address can be read and configured (written) via
NFC as described in chapter 6.
The structure of ExRPB static addresses is as follows:
The upper 2 bytes of the source address are used to identify the device type and set
to 0xE215 for all ExRPB devices (to designate the use of an EnOcean PTM 215B mod-
ule). These two bytes cannot be changed.
The lower 4 bytes are uniquely assigned to each device. They can be changed using
the NFC configuration interface as described in chapter 6.7.2
Figure 10 below illustrates the static address structure used by ExRPB.
Figure 10 –BLE static source address structure
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 15/68
4.4.2 Private resolvable source address mode
For some applications it is desirable to modify (rotate) the source address used by ExRPB in
order to prevent tracking of radio transmissions originating from a specific device. At the
same time, each such device must remain uniquely identifiable by the receiver.
To achieve these goals, ExRPB can be configured via NFC to use random resolvable private
addresses.
Using random resolvable private addresses requires that both ExRPB and the receiver both
know a common key –the so-called Identity Resolution Key (IRK). ExRPB uses its device-
unique random key as identity resolution key. This key can be configured via the NFC con-
figuration interface as described in chapter 6.
For resolvable private addresses, the 48 bit address field is split into two sub-fields:
prand
This field contains a random number which always starts (two most significant bits)
with 0b10. The prand value is changed for each telegram that is transmitted. Indi-
vidual advertising events used to transmit one telegram (as described in chapter 3)
use the same prand value.
hash
This field contains a verification value (hash) generated from prand using the IRK
The structure of a random resolvable private address is shown in Figure 11 below.
Figure 11 –BLE private resolvable source address structure
The prand value is encrypted using the IRK. The lowest 24 bit of the result (encrypted val-
ue) are then used as hash.
The concatenation of 24 bit prand and 24 bit hash will be transmitted as 48 bit private re-
solvable source address.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 16/68
The receiving device maintains a list of IRK for all transmitters that have been commis-
sioned to work with it.
Whenever the receiving device receives a radio telegram with private resolvable source
address (identified by the most significant bits being set to 0b10), it will itself generate a 24
bit hash from the 24 bit prand sequentially using the IRK of each device that it has been
learned into it.
If an IRK matches (i.e. when prand is encoded with this specific IRK then the result match-
es hash), then the receiver has established the identity of the transmitter.
So conceptually the IRK takes the role of the device source address while prand and hash
provide a mechanism to select the correct IRK among a set of IRK.
This mechanism is illustrated in Figure 12 below.
Figure 12 –Resolving private source addresses
4.5 Check Sum
The 3 byte BLE Check Sum is used to verify data integrity of received BLE radio telegrams.
It is calculated as CRC (cyclic redundancy check) of the BLE Header, Source Address and
Payload fields.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 17/68
4.6 Payload
The payload of data telegrams is 13 … 17 bytes long (depending on the size of the Optional
Data field) and consists of the following fields:
Length (1 byte)
The Length field specifies the combined length of the following fields. The content of
the field depends on the size of the Optional Data field (which can be 0 / 1 / 2 or 4
byte).
The resulting Length setting would be 12 / 13 / 14 or 16 byte (0x0C / 0x0D / 0x0E /
0x10) respectively
Type (1 byte)
The Type field identifies the data type used for this telegram. For PTM 215B data
telegrams, this field is always set to 0xFF to designate manufacturer-specific data
field
Manufacturer ID (2 byte)
The Manufacturer ID field is used to identify the manufacturer of BLE devices based
on assigned numbers. EnOcean has been assigned 0x03DA as manufacturer ID code.
The Manufacturer ID can be changed via the NFC configuration interface as de-
scribed in chapter 6.7.4.
Sequence Counter (4 byte)
The Sequence Counter is a continuously incrementing counter used for security
processing. It is initialized to 0at the time of production and incremented for each
telegram (data telegram or commissioning telegram) sent.
Switch Status (1 byte)
The Switch Status field reports the button action. The encoding of this field is de-
scribed in chapter 4.7.
Optional Data (0 / 1 / 2 or 4 byte)
PTM 215B provides the option to transmit additional user-defined data within each
data telegram. This data can be used to identify user-specific properties.
The length of the Optional Data field is defined in the Configuration register as de-
scribed in chapter 6.7.6.
Security Signature (4 byte)
The Security Signature is used to authenticate ExRPB radio telegrams as described
in chapter 4.8
Figure 13 below illustrates the data telegram payload.
Figure 13 –Data telegram payload structure
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 18/68
4.7 Switch status encoding
The Switch Status field within the Payload data identifies the ExRPB action (rocker push or
release). ExRPB uses the following sequence to identify and transmit the rocker status:
1. Determine direction of the rocker movement (Push Action or Release Action)
2. Read input status of all button contacts
3. Calculate data payload
4. Calculate security signature
In ExRPB, the type of action (Press Action or Release Action) is indicated by Bit 0 (Energy
Bar). If a button contact has been actuated during Press Action or Release Action then this
is indicated by the according status bit set to ‘1’.
Note that all contacts that were pressed during Press Action will be released during Release
Action. The case of continuing to hold one (or several) button contacts during Release Ac-
tion is mechanically not possible.
The switch status encoding used by ExRPB is shown Figure 14 in below.
Figure 14 –ExRPB button action encoding
In the dual rocker variant EDRPB, one rocker actuates B1 and B0 while the other rocker
actuates A1 and A0.
In the single rocker variant ESRPB, the rocker actuates B1 and B0. The buttons A1 and A0
are not used.
The direction of the actuation (press or release) is indicated by the ACTION TYPE field.
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 19/68
4.8 ExRPB telegram authentication
ExRPB implements telegram authentication to ensure that only telegrams from senders
using a previously exchanged security key will be accepted. Authentication relies on a 32
bit telegram signature which is calculated as shown in Figure 15 below and exchanged as
part of the radio telegram.
Figure 15 –Telegram authentication flow
Sequence counter, source address and the remaining telegram data together form the in-
put data for the signature algorithm. This algorithm uses AES128 encryption based on the
device-unique random security key to generate a 32 bit signature which will be transmitted
as part of the radio telegram.
The signature is therefore dependent both on the current value of the sequence counter,
the device source address and the telegram payload. Changing any of these three parame-
ters will therefore result in a different signature.
The receiver performs the same signature calculation based on sequence counter, source
address and the remaining telegram data of the received telegram using the security key it
received from ExRPB during commissioning.
The receiver then compares the signature reported as part of the telegram with the signa-
ture it has calculated. If these two signatures match then the following statements are
true:
Sender (ExRPB) and receiver use the same security key
The message content (address, sequence counter, data) has not been modified
At this point, the receiver has validated that the message originates from a trusted sender
(as identified by its security key) and that its content is valid.
In order to avoid message replay (capture and retransmission of a valid message), it is
required that the receiver tracks the value of the sequence counter used by ExRPB and only
accepts messages with higher sequence counter values (i.e. not accepts equal or lower se-
quence counter values for subsequent telegrams).
USER MANUAL
ESRPB / EDRPB - EASYFIT BLUETOOTH® SINGLE / DOUBLE ROCKER PAD
© 2018 EnOcean | www.enocean.com F-710-017, V1.0 ESRPB / EDRPB User Manual | v1.3 | Jan 2018 | Page 20/68
4.8.1 Authentication implementation
ExRPB implements telegram authentication based on AES128 in CCM (Counter with CBC-
MAC) mode as described in IETF RFC3610. At the time of writing, the RFC3610 standard
could be found here: https://www.ietf.org/rfc/rfc3610.txt
The 13 Byte CCM Nonce (number used once –unique) initialization value is constructed as
concatenation of 6 byte Source Address, 4 byte Sequence Counter and 3 bytes of value
0x00 (for padding).
Note that both Source Address and Sequence Counter use little endian format (least signifi-
cant byte first).
Figure 16 below shows the structure of the AES128 Nonce.
Figure 16 –AES128 Nonce structure
The AES128 Nonce and the 128 bit device-unique security key are then used to calculate a
32 bit signature of the authenticated telegram payload shown in Figure 17 below.
Figure 17 –Authenticated payload
The calculated 32 bit signature is then appended to the data telegram payload as shown in
Figure 13 in chapter 4.6.
In addition to the RFC3610 standard itself, please consult also Appendix A for a step by
step description of the authentication process.
This manual suits for next models
1
Table of contents
Other EnOcean Switch manuals
