EnOcean PTM 216B User manual

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 1/49
Patent protected:
WO98/36395, DE 100 25 561, DE 101 50 128,
WO 2004/051591, DE 103 01 678 A1, DE 10309334,
WO 04/109236, WO 05/096482, WO 02/095707,
US 6,747,573, US 7,019,241
Observe precautions! Electrostatic sensitive devices!
PTM 216B Bluetooth®Pushbutton Transmitter Module
25 May 2023

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 2/49
REVISION HISTORY
The following major modifications and improvements have been made to this document:
Version
Author
Reviewer
Date
Major Changes
1.0
MKA
MK
25 May 2023
Initial Customer Release
Published by EnOcean GmbH, Kolpingring 18a, 82041 Oberhaching, Germany
www.enocean.com, [e-mail], phone [phone]
© EnOcean GmbH, All Rights Reserved
The Bluetooth®word mark and logos are registered trademarks owned by the Bluetooth
SIG, Inc. and any use of such marks by EnOcean GmbH is under license. Other trademarks
and trade names are those of their respective owners.
Important!
This information describes the type of component and shall not be considered as assured
characteristics. No responsibility is assumed for possible omissions or inaccuracies. Circuitry
and specifications are subject to change without notice. For the latest product specifications,
refer to the EnOcean website: http://www.enocean.com.
As far as patents or other rights of third parties are concerned, liability is only assumed for
modules, not for the described applications, processes and circuits. EnOcean does not assume
responsibility for use of modules described and limits its liability to the replacement of mod-
ules determined to be defective due to workmanship. Devices or systems containing RF com-
ponents must meet the essential requirements of the local legal authorities. The modules
must not be used in any relation with equipment that supports, directly or indirectly, human
health or life or with applications that can result in danger for people, animals or real value.
Components of the modules are considered and should be disposed of as hazardous waste.
Local government regulations are to be observed. Packing: Please use the recycling operators
known to you.

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 3/49
TABLE OF CONTENT
1. General description........................................................................................5
1.1 Basic functionality .........................................................................................5
1.2 Technical data...............................................................................................6
1.3 Environmental conditions ...............................................................................6
1.4 Packaging information....................................................................................6
1.5 Ordering information .....................................................................................6
2. Functional information ...................................................................................7
2.1 Product overview...........................................................................................7
2.2 Basic functionality .........................................................................................7
2.3 Functional block diagram................................................................................8
2.4 User Interface...............................................................................................9
3. Telegram transmission ................................................................................. 10
3.1 Radio channel parameters ............................................................................ 10
3.2 Default radio transmission sequence .............................................................. 11
3.3 User-defined radio transmission sequences..................................................... 11
3.3.1 Supported radio transmission sequences .................................................... 12
3.3.2 Three-channel radio transmission sequence ................................................ 12
3.3.3 Two-channel radio transmission sequence .................................................. 13
3.3.4 Single-channel radio transmission sequence ............................................... 13
4. Telegram format ......................................................................................... 14
4.1 Preamble.................................................................................................... 14
4.2 Access Address ........................................................................................... 14
4.3 Header....................................................................................................... 14
4.4 Source address ........................................................................................... 15
4.4.1 Static source address mode ...................................................................... 15
4.4.2 Resolvable private address mode............................................................... 16
4.5 Check Sum ................................................................................................. 17
4.6 Telegram payload........................................................................................ 18
4.6.1 Data telegram payload ............................................................................. 18
4.6.2 Button action encoding............................................................................. 19
4.6.3 Commissioning telegram payload .............................................................. 20
4.7 PTM 216B data telegram authentication ......................................................... 21
4.7.1 Authentication implementation .................................................................. 22
5. Commissioning............................................................................................ 23
5.1 NFC-based commissioning ............................................................................ 24
5.2 Camera-based commissioning....................................................................... 25
5.3 Radio-based commissioning.......................................................................... 25
5.3.1 Commissioning mode entry....................................................................... 25
5.3.2 Commissioning telegram transmission........................................................ 26
5.3.3 Exit from commissioning mode.................................................................. 26
5.3.4 Disable commissioning mode .................................................................... 26
5.4 Factory reset .............................................................................................. 27
6. NFC interface .............................................................................................. 28
6.1 NFC interface parameters ............................................................................. 28
6.2 NFC access protection .................................................................................. 28
6.3 Using the NFC interface................................................................................ 28
6.3.1 PC with dedicated NFC reader ................................................................... 29

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 4/49
6.3.2 Android or iOS smartphone with NFC ......................................................... 29
7. PTM 216B device label ................................................................................. 30
7.1 PTM 216B device label structure.................................................................... 30
7.2 QR code format........................................................................................... 31
8. Device integration ....................................................................................... 32
8.1 Mechanical interface characteristics ............................................................... 32
8.2 Mechanical interface drawings....................................................................... 32
8.3 OEM product QR code .................................................................................. 37
9. Application information ................................................................................ 38
9.1 Transmission range ..................................................................................... 38
9.2 Receiver configuration ................................................................................. 39
9.2.1 Advertising interval.................................................................................. 40
9.2.2 Scan window........................................................................................... 40
9.2.3 Scan interval........................................................................................... 41
9.2.4 Summary ............................................................................................... 41
10. Regulatory information................................................................................. 42
10.1 RED for European Market ........................................................................ 42
10.2 FCC (United States) ................................................................................ 43
10.2.1 Certificate............................................................................................... 43
10.2.2 Regulatory Statement .............................................................................. 44
10.3 ISED (former Industry Canada) ................................................................ 45
10.3.1 Certificate............................................................................................... 45
10.3.2 Regulatory Statement .............................................................................. 46
10.4 ARIB (Japan) Construction Type Conformity Certifaction.............................. 48
11. Product history............................................................................................ 49

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 5/49
1. General description
1.1 Basic functionality
PTM 216B enables the realization of energy harvesting wireless switches for lighting, building
or industrial automation control systems using Bluetooth®low energy technology. PTM 216B
is the successor of PTM 215B product providing higher transmission power while maintaining
functional backwards compatibility.
PTM 216B is uses the standard EnOcean PTM 210 form factor enabling quick integration into
a wide range of designs. Key applications are wall-mounted or portable switches either with
up to two rockers or up to four push buttons.
PTM 216B pushbutton transmitters are self-powered (no batteries) and fully maintenance-
free. They can therefore be used in all environments including locations that are difficult to
reach or within hermetically sealed housings. The required energy is generated by an electro-
dynamic energy transducer actuated by an energy bow located on the left and right of the
module. This energy bow which can be pushed from outside the module by an appropriate
pushbutton or switch rocker.
When the energy bow is pushed down or released, electrical energy is created and a radio
telegram according to the Bluetooth®low energy standard is transmitted. This radio telegram
transmits the status of all four contact nipples when the energy bow was pushed down or
released. PTM 216B radio telegrams are protected with AES-128 security based on a device-
unique private key.
PTM 216B is available in the following variants:
◼PTM 216B
Stand-alone module without additional components for OEM integration
◼EWSSB / EWSDB
PTM 216B integrated into European-style single / double rocker wall switch housing
◼ESRPB / EDRPB
PTM 216B integrated into US-style single or double rocker pad housing
The term “PTM 216B” as used in this document applies to all product variants unless other-
wise mentioned. Figure 1 below shows from left to right the PTM 216B module, the EWSSB /
EWSDB European wall switches and the ESRPB / EDRPB US-style rocker pads.
Figure 1 –PTM 216B, EWSSB/EWSDB and ESRPB/EDRPB

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 6/49
1.2 Technical data
Antenna
Integrated PCB antenna
Transmission power (typical)
+4 dBm
Communication Range (guidance only)
75 m ideal line of sight / 10 m indoor environment
Communication Standard
Bluetooth Low Energy (BLE)
Radio Frequency (min / max)
2402 MHz / 2480 MHz
Radio Channels (default)
CH 37 / 38 / 39 (2402 MHz / 2426 MHz / 2480 MHz)
Data Rate and Modulation
1 Mbit/s GFSK (default) / 2 Mbit GFSK (NFC option)
Configuration Interface
NFC Forum Type 2 Tag (ISO/IEC 14443 Part 2 and 3)
Device Identification
Unique 48 Bit Device ID (factory programmed)
Security
AES128 (CBC Mode) with Sequence Code
Power Supply
Integrated Kinetic Energy Harvester
Button Inputs
Up to four buttons or two rockers
Dimensions
40.0 x 40.0 x 11.2 mm
Weight
20 g +/- 1g
1.3 Environmental conditions
Operating Temperature
-25°C ... 65°C
Storage Temperature
-25°C ... 65°C
Humidity
0% to 95% r.h. (non-condensing)
Operation at very low (below 0°C) or very high temperatures (above 40°C) might
affect the mechanical behaviour of rocker switches due to mechanical expansion or
contraction of the rockers. Correct operation at such temperatures should be verified
as part of the mechanical design by customers.
1.4 Packaging information
Packaging Unit 100 units
Packaging Method Tray / Box (10 units per tray, 10 trays per box)
1.5 Ordering information
Type
Ordering Code
Description
PTM 216B
S3221-A216
Module only
EWSSB
E8221-A270:DB
Wall Switch (Single Rocker, see separate documentation)
EWSDB
E8221-A280:DB
Wall Switch (Double Rocker, see separate documentation)
ESRPB
ESRPB-W-EnOcean:DB
Rocker Pad (Single Rocker, see separate documentation)
EDRPB
EDRPB-W-EnOcean:DB
Rocker Pad (Double Rocker, see separate documentation)

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 7/49
2. Functional information
2.1 Product overview
The pushbutton transmitter module PTM 216B from EnOcean enables the implementation of
wireless remote controls without batteries. It transmits Bluetooth Low Energy (BLE) data
telegrams where the required energy is provided by a built-in electro-dynamic energy gen-
erator.
The PTM 216B product outline with key functional components is shown in Figure 2 below.
Figure 2 –PTM 216B Product Outline
2.2 Basic functionality
PTM 216B devices contain an electro-dynamic energy converter which is actuated by an en-
ergy bow (1). This bow is pushed by an appropriate push button, switch rocker or a similar
construction mounted onto the device. An internal spring will release the energy bow as soon
as it is not pushed down anymore.
When the energy bow is pushed down, electrical energy is created and a BLE radio telegram
is transmitted which identifies the action (pressed or not pressed) and the status of the four
button contacts (2). Releasing the energy bow similarly generates energy which is used to
transmit a different radio telegram.
It is therefore possible to distinguish between radio telegrams sent when the energy bar was
pushed and radio telegrams sent when the energy bar was released.
By identifying these different telegrams types and measuring the time between pushing and
releasing of the energy bar, it is possible to distinguish between “Long” and “Short” button
contact presses. This enables simple implementation of applications such as dimming control
or blinds control including slat action.
(2) Button contacts
for switch rocker
identification
(1) Energy bow
on both device sides
Snap-in and
rotation axis for
pushbuttons or
switch rocker

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 8/49
2.3 Functional block diagram
Figure 3 –Functional block diagram of PTM 216B
Energy Bow / Power Generator
Converts the motion of the energy bow into electrical energy
Power Converter
Converts the energy of the power generator into a stable DC supply voltage for the device
electronics
Processor
Determines the status of the button contacts and the energy bow, encodes this status into a
data word, generates the proper radio telegram structure and sends it to the radio transmitter
RF transmitter
Transmits the data in the form of a series of short 2.4 GHz Bluetooth Low Energy radio
telegrams using the integrated antenna
NFC interface
Allows reading and writing certain product parameters using an NFC compliant reader / writer
supporting NFC Forum Type 2 tags (as specified by ISO/IEC 14443 Part 2 and 3).
Processor
Energy
Bow
Power
Converter
Data
DC Power
Pushed
/
Released
Ant
N
S
Processor
Button Contacts
Energy
Bow
Power
Converter
Data
DC Power
Push / Release
Detection
Antenna
N
S
N
S
NFC
RF Transmitter

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 9/49
2.4 User Interface
PTM 216B devices provide four button contacts. They are grouped into two channels (Channel
A and Channel B) each containing two button contacts (State O and State I).
The state of all four button contacts (pressed or not pressed) is transmitted together with a
unique device identification (48 Bit device ID) whenever the energy bow is pushed or re-
leased.
Figure 4 below shows the arrangement of the four button contacts and their designation:
Figure 4 –Button contact designation
O
I
BA
CHANNEL
STATE
O
I
BA
CHANNEL
STATE

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 10/49
3. Telegram transmission
3.1 Radio channel parameters
PTM 216B transmits Bluetooth Low Energy (BLE) advertising telegrams within the 2.4 GHz
radio frequency band (2402MHz … 2480MHz).
By default, PTM 216B will use the three BLE advertising channels (BLE Channel 37, 38 and
39) defined for transmission. The transmission of a radio telegram on these three advertis-
ing channels is called an Advertising Event.
Use of different radio channels within the frequency band from 2402 MHz to 2480 MHz is
possible via NFC configuration as described in chapter 6.
The initialization value for data whitening is set as follows:
◼For BLE channels is set according to specification (value = radio channel)
◼For the custom radio channels the initialization value is equal to the offset from
2400 MHz (e.g. value = 3 for 2403 MHz)
Table 1 below summarizes radio channels supported by PTM 216B.
Radio Channel
Frequency
Channel Type
BLE Radio Channels
37
2402 MHz
BLE Advertising Channel
0
2404 MHz
BLE Data Channel
1
2406 MHz
BLE Data Channel
…
10
2424 MHz
BLE Data Channel
38
2426 MHz
BLE Advertising Channel
11
2428 MHz
BLE Data Channel
12
2430 MHz
BLE Data Channel
…
36
2478 MHz
BLE Data Channel
39
2480 MHz
BLE Advertising Channel
Custom Radio Channels
40
2403 MHz
Custom Radio Channel
41
2405 MHz
Custom Radio Channel
…
77
2477 MHz
Custom Radio Channel
78
2479 MHz
Custom Radio Channel
Table 1 –PTM 216B supported radio channels

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 11/49
3.2 Default radio transmission sequence
PTM 216B transmits telegrams in its standard configuration by using so-called Advertising
Events.
An advertising event is defined as the transmission of the same radio telegram on all selected
radio channels (by default this would be on BLE Channel 37, 38 and 39) one after another
with minimum delay in between.
For reliability reasons, PTM 216B will send several (minimum two, maximum three) adver-
tising events for each button input. The resulting transmission sequence is shown in Figure
5 below.
The default interval between the advertising events is 20 ms. Starting with product version
DC-06 it is possible to reduce this interval to 10 ms via NFC configuration as described in
chapter 6.
Figure 5 –Default radio transmission sequence
3.3 User-defined radio transmission sequences
In certain situations, it might be desirable to transmit radio telegrams on channels other than
the three advertising channels.
PTM 216B therefore allows to select the radio channels to be used for the transmission of
data telegrams and commissioning telegrams. The following transmission modes are sup-
ported:
◼Both commissioning telegrams and data telegrams are transmitted on the advertis-
ing channels as three advertising events. This is the default configuration and de-
scribed in chapter 3.2 above.
◼Commissioning telegrams are transmitted on the advertising channels as three ad-
vertising events while data telegrams are transmitted in a user-defined sequence as
described below.
◼Both commissioning and data telegrams are transmitted in a user-defined sequence
as described below.
The selection of the transmission mode is via NFC configuration as described in chapter 6.
CH 37 CH 38 CH 39 INTERVAL
(20ms or 10ms)
INTERVAL
(20ms or 10ms)
CH 37 CH 38 CH 39 CH 37 CH 38 CH 39

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 12/49
3.3.1 Supported radio transmission sequences
PTM 216B supports the following user-defined sequences:
◼Three channel sequence
This sequence is similar to the default Advertising Event with the difference that the
user can select the radio channels to be used. The three-channel sequence is de-
scribed in chapter 3.3.2 below.
◼Two channel sequence
In this sequence the radio telegram is transmitted using four transmissions on two
radio channels. It is described in chapter 3.3.3 below.
◼One channel sequence
In this sequence the radio telegram is transmitted using six transmissions on one
radio channel. It is described in chapter 3.3.4 below.
The selection of user-defined radio transmission sequences is made via NFC configuration as
described in chapter 6.
3.3.2 Three-channel radio transmission sequence
The three-channel radio transmission sequence is similar to the default transmission se-
quence. The difference is that the radio channels (BLE Channel 37, 38 and 39 in the default
transmission sequence) can be selected using the registers TX_CHANNEL1, TX_CHANNEL2and
TX_CHANNEL3.
The PTM 216B telegram will in this mode be transmitted on the radio channel selected by
TX_CHANNEL1first, immediately followed by a transmission on the radio channel selected by
TX_CHANNEL2and a transmission on the radio channel selected by TX_CHANNEL3.
This transmission sequence will be sent three times in total as shown in Figure 6 below.
The default interval between the advertising events is 20 ms; it is possible to reduce this
interval to 10 ms via NFC configuration as described in chapter 6.
Figure 6 –Three channel radio transmission sequence
TX_CHANNEL1 TX_CHANNEL2 TX_CHANNEL3 TX_CHANNEL1 TX_CHANNEL2 TX_CHANNEL3 TX_CHANNEL1 TX_CHANNEL2 TX_CHANNEL3
INTERVAL
(20ms or 10ms)
INTERVAL
(20ms or 10ms)

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 13/49
3.3.3 Two-channel radio transmission sequence
The two-channel radio transmission sequence removes transmission on the third radio chan-
nel (selected by TX_CHANNEL3) and instead repeats the transmission once more (four times in
total).
The PTM 216B telegram will in this mode be transmitted on the radio channel selected by
TX_CHANNEL1first, immediately followed by a transmission on the radio channel selected by
TX_CHANNEL2.
This two-channel transmission sequence will be sent four times in total as shown in Figure 7
below.
The default interval between the advertising events is 20 ms; it is possible to reduce this
interval to 10 ms via NFC configuration as described in chapter 6.
Figure 7 –Two channel radio transmission sequence
3.3.4 Single-channel radio transmission sequence
The single-channel radio transmission sequence removes transmission on the second and
third radio channel (selected by TX_CHANNEL2 and TX_CHANNEL3respectively), i.e. all transmis-
sions will be on the radio channel selected by TX_CHANNEL1.
The PTM 216B telegram will be sent six times on this radio channel as shown in Figure 8
below.
The default interval between the advertising events is 20 ms; it is possible to reduce this
interval to 10 ms via NFC configuration as described in chapter 6.
Figure 8 –Single channel radio transmission sequence
TX_CHANNEL1 TX_CHANNEL2 TX_CHANNEL1 TX_CHANNEL2
INTERVAL
(20ms or 10ms) TX_CHANNEL1 TX_CHANNEL2
INTERVAL
(20ms or 10ms) TX_CHANNEL1 TX_CHANNEL2
INTERVAL
(20ms or 10ms)
TX_CHANNEL1 TX_CHANNEL1
INTERVAL
(20ms or 10ms) TX_CHANNEL1
INTERVAL
(20ms or 10ms) TX_CHANNEL1
INTERVAL
(20ms or 10ms) TX_CHANNEL1
INTERVAL
(20ms or 10ms) TX_CHANNEL1
INTERVAL
(20ms or 10ms)

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 14/49
4. Telegram format
PTM 216B transmits Bluetooth Low Energy (BLE) radio telegrams in the 2.4 GHz band. For
detailed information about the Bluetooth Low Energy standard, please refer to the applicable
specifications.
Figure 9 below summarizes the BLE frame structure.
Figure 9 –BLE frame structure
The content of these fields is described in more detail below.
4.1 Preamble
The BLE Preamble is 1 byte long and identifies the start of the BLE frame. The value of the
BLE Preamble is always set to 0xAA.
4.2 Access Address
The 4 byte BLE Access Address identifies the radio telegram type. For advertising frames,
the value of the Access Address is always set to 0x8E89BED6.
4.3 Header
The BLE Header identifies certain radio telegram parameters. Figure 10 below shows the
structure of the BLE header.
Figure 10 –BLE header structure

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 15/49
4.4 Source address
The 6 byte BLE Source Address (MAC address) uniquely identifies each PTM 216B product.
PTM 216B supports two source address modes:
◼Static Source Address mode (default)
In this mode, the source address is constant (but its lower 32 bit can be configured
via NFC interface)
◼Resolvable Private Address mode (NFC configurable option)
In this mode, the source address changes for each transmission
By default, PTM 216B uses Static Source Address mode. Private Resolvable Address mode
can be selected via NFC configuration as described in chapter 6. These two address modes
are described in the following chapters.
4.4.1 Static source address mode
By default, PTM 216B uses static source addresses meaning that the source address is con-
stant during normal operation. The static source address can be read and configured (written)
via NFC as described in chapter 6.
The structure of PTM 216B static addresses is as follows:
◼The upper 2 bytes of the source address are used to identify the device type and set
to 0xE215 for all PTM 216B devices (to designate EnOcean PTM 215 device type).
These two bytes cannot be changed.
◼The lower 4 bytes are uniquely assigned to each device.
Figure 11 below illustrates the static address structure used by PTM 216B.
Figure 11 –BLE static source address structure

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 16/49
4.4.2 Resolvable private address mode
For some applications it is desirable to obfuscate the origins of PTM 216B data telegrams in
order to prevent tracking of its radio transmissions. This can be achieved by using resolvable
private addresses (RPA) as defined in the Bluetooth Core Specification.
PTM 216B can be configured to use resolvable private addresses via NFC configuration as
described in chapter 6.
When using resolvable private addresses, the address used by PTM 216B is modified (rotated)
according to a defined scheme which on one hand precludes determining the device identity
by unauthorized receivers while allowing authorized receivers (sharing a specific security key
with PTM 216B) to do so.
The shared security key –which has to be known by both PTM 216B and the authorized
receiver –is called the Identity Resolution Key (IRK). PTM 216B uses its device-unique ran-
dom key as identity resolution key. This key can be modified if needed via via NFC configu-
ration as described in chapter 6.
For each data telegram transmitted by PTM 216B (i.e. for every button push or release), a
new resolvable private address is generated. The 48 bit address field of such resolvable pri-
vate address is split into two sub-fields:
◼prand
This field contains a random number which always starts (two most significant bits)
with 0b10. The prand value is changed for each telegram that is transmitted.
Individual advertising events used to transmit the same telegram (as described in
chapter 3) use the same prand value.
◼hash
This field contains a verification value (hash) generated from prand using the IRK
The structure of a resolvable private address is shown in Figure 12 below.
Figure 12 –BLE resolvable private address structure
The prand value is encrypted using the IRK. The lowest 24 bit of the result (encrypted value)
are then used as hash. The concatenation of 24 bit prand and 24 bit hash will be transmitted
as 48 bit private resolvable source address.
The receiver maintains a list of IRK for all transmitters that have been commissioned to work
with it.

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 17/49
Whenever the receiver receives a data telegram with a resolvable private address (identified
by the most significant bits of the address field being set to 0b10), it will itself generate a 24
bit hash from the 24 bit prand sequentially using each IRK known to it (i.e. the IRK of each
device that has been learned into it).
If an IRK matches (i.e. when prand is encoded with the IRK then the result matches hash),
then the receiver has established the IRK used by the transmitter and thereby the identity of
the transmitter.
So conceptually the IRK takes the role of the device address of the transmitter while prand
and hash provide a mechanism for the receiver to select the correct IRK among the set of
IRK known to it.
This mechanism is illustrated in Figure 13 below.
Figure 13 –Resolving private addresses
Note that commissioning telegrams (as described in chapter 5.3.2) always use static source
addresses (as described in chapter 4.4.1) since they establish the device identity and contain
the IRK in the payload.
4.5 Check Sum
The 3 byte BLE Check Sum is used to verify data integrity of received BLE radio telegrams.
It is calculated as CRC (cyclic redundancy check) of the BLE Header, Source Address and
Payload fields.

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 18/49
4.6 Telegram payload
PTM 216B can transmit two types of telegrams:
◼Data telegrams
The payload of data telegrams contains the switch status together with optional data
(if applicable), the current sequence counter value and the resulting authentication
signature
◼Commissioning telegrams
The payload of commissioning telegrams contains the private security key as well as
the current value of the sequence counter and the device address
The payload structure of both telegram types is described in the following chapters.
4.6.1 Data telegram payload
The payload of data telegrams is 13 … 17 bytes long (depending on the size of the Optional
Data field) and consists of the following fields:
◼Length (1 byte)
The Length field specifies the combined length of the following fields. The content of
the field depends on the size of the Optional Data field (which can be 0 / 1 / 2 or 4
byte). The resulting Length setting would be 12 / 13 / 14 or 16 byte (0x0C / 0x0D /
0x0E / 0x10) respectively
◼Type (1 byte)
The Type field identifies the data type used for this telegram. For PTM 216B data tel-
egrams, this field is always set to 0xFF to designate manufacturer-specific data field
◼Manufacturer ID (2 byte)
The Manufacturer ID field is used to identify the manufacturer of BLE devices based
on assigned numbers. EnOcean has been assigned 0x03DA as manufacturer ID code.
◼Sequence Counter (4 byte)
The Sequence Counter is a continuously incrementing counter used for security pro-
cessing. It is initialized to 0at the time of production and incremented for each tele-
gram (data telegram or commissioning telegram) sent.
◼Switch Status (1 byte)
The Switch Status field reports the button action. The encoding of this field is de-
scribed in chapter 4.6.2.
◼Optional Data (0 / 1 / 2 or 4 byte)
PTM 216B provides the option to transmit additional user-defined data within each
data telegram via NFC configuration as described in chapter 6.
◼Security Signature (4 byte)
The Security Signature is used to authenticate PTM 216B radio telegrams as de-
scribed in chapter 4.6.3

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 19/49
Figure 14 below illustrates the data telegram payload.
Figure 14 –Data telegram payload structure
4.6.2 Button action encoding
The Switch Status field within the data telegram payload identifies the PTM 216B button
action (button push or release). PTM 216B uses the following sequence to identify and trans-
mit button contact status:
1. Determine direction of the energy bar movement (Push Action or Release Action)
2. Read input status of all button contacts
3. Calculate data payload
4. Calculate security signature
In PTM 216B, the type of action (Press Action or Release Action) is indicated by Bit 0 (Energy
Bar). If a button contact has been actuated during Press Action or Release Action, then this
is indicated by the according status bit set to ‘1’.
Note that all contacts that were pressed during Press Action will be released during Release
Action. The case of continuing to hold one (or several) button contacts during Release Action
is mechanically not possible.
The default button action encoding used by PTM 216B is shown Figure 15 in below. It is
possible to modify this encoding using the NFC interface.
Figure 15 - PTM 216B button action encoding

USER MANUAL
PTM 216B –BLUETOOTH®PUSHBUTTON TRANSMITTER MODULE
© 2023 EnOcean | www.enocean.com F-710-017, V1.0 PTM 216B User Manual | v1.0 | May 2023 | Page 20/49
4.6.3 Commissioning telegram payload
The payload of commissioning telegrams is 30 bytes long and consists of the following fields:
◼Length (1 byte)
The Length field specifies the combined length of the following fields. For PTM 216B
commissioning telegrams, this field is set to 0x1Dto indicate 29 byte of manufac-
turer-specific data.
Note: In product versions prior to DC-06 this field was incorrectly set to 0x1E.
◼Type (1 byte)
The Type field identifies the data type used for this telegram. This field is set to 0xFF
to indicate a “Manufacturer-specific Data” field
◼Manufacturer ID (2 byte)
The Manufacturer ID field is used to identify the manufacturer of BLE devices based
on assigned numbers. This field is set to 0x03DA (EnOcean GmbH).
◼Sequence Counter (4 byte)
The Sequence Counter is a continuously incrementing counter used for security pro-
cessing. It is initialized to 0 at the time of production and incremented for each tele-
gram (data telegram or commissioning telegram) sent.
◼Security Key (16 byte)
Each PTM 216B device contains its own 16 byte device-unique random security key
which is generated and programmed during manufacturing. It is transmitted during
commissioning to enable the receiver to authenticate PTM 216B data telegrams and
used as IRK for the case of resolvable private address mode
◼Static Source Address (6 byte)
The Static Source Address is used to uniquely identify each BLE device. It is trans-
mitted as part of the BLE frame as described in chapter 4.4.1.
Some devices (most notable all iOS-based products) however do not expose this ad-
dress to their applications. This makes it impossible to use such applications to com-
mission PTM 216B. The Static Source Address is therefore again transmitted as part
of the payload.
Figure 16 below illustrates the commissioning telegram payload.
Figure 16 –Commissioning telegram payload structure