Hoft & Wessel HW 86012 Use and care manual

Firmware Manual
HW 86012 / HW 86022
DECT / FHSS
Embedded Radio Module
Version 2.10

This document and its contents shall not be reproduced or transferred in any form without express permission.
Compensation will be claimed for any infringement. All rights reserved in the event of patenting or registration of utility
models.
© Höft & Wessel AG 2007
Subject to amendment, errors excepted
HW86012_FM_210.doc

PREFACE
About this Document
2.10 •19.01.2007 3
Contents
1. Preface....................................................................................................................................................... 7
1.1 About this Document .......................................................................................................................... 7
1.2 Contact Höft & Wessel AG ................................................................................................................. 7
2. Product Overview..................................................................................................................................... 8
2.1 General Description ............................................................................................................................ 8
2.2 Summary of Features ....................................................................................................................... 10
2.3 Principles of operation ...................................................................................................................... 11
2.3.1 DECT Network Entities ............................................................................................................. 11
2.3.2 Connections .............................................................................................................................. 12
3. Firmware description ............................................................................................................................. 13
3.1 Overview........................................................................................................................................... 13
3.1.1 Operation Modes ...................................................................................................................... 13
3.1.2 Mode Selection ......................................................................................................................... 14
3.1.2.1 Selection by Reset Sequence ........................................................................................... 14
3.1.2.2 Selection by Software Escape Sequence ......................................................................... 14
3.2 System Security................................................................................................................................ 15
3.2.1 DECT Identities......................................................................................................................... 16
3.2.1.1 FT related Identities........................................................................................................... 16
3.2.1.2 PT related Identities .......................................................................................................... 17
3.2.1.3 Subscription Identities ....................................................................................................... 18
3.2.2 EasySubs .................................................................................................................................. 19
3.2.3 On-Air Subscription of Portable Terminals ............................................................................... 20
3.2.4 Offline Subscription of Portable Terminals ............................................................................... 20
3.3 Data Mode ........................................................................................................................................ 21
3.3.1 Point to Point Operation............................................................................................................ 21
3.3.2 Point to Multipoint Operation..................................................................................................... 21
3.3.3 Point to Multipoint Networking Operation ................................................................................. 22
3.3.3.1 TCP/IP Data Mode ............................................................................................................ 23
3.3.3.2 SWAP Data Mode ............................................................................................................. 24
3.3.3.3 PPP Data Mode................................................................................................................. 25
3.3.4 Transparent Data Mode ............................................................................................................ 25
3.3.4.1 Usage of RS-232 interface................................................................................................26
3.3.4.1.1 Connection of the interface ..................................................................................... 26
3.3.4.1.2 Interface parameters............................................................................................... 26
3.3.4.2 Flow Control ...................................................................................................................... 26
3.3.4.3 Interworking of Modem lead Signals ................................................................................. 27
3.3.4.4 Call Control........................................................................................................................ 27
3.3.4.4.1 Outgoing call, PT interface...................................................................................... 28
3.3.4.4.2 Outgoing call, FT interface...................................................................................... 28
3.3.4.4.3 Incoming call, PT interface...................................................................................... 29
3.3.4.4.4 Incoming call, FT interface...................................................................................... 29
3.3.4.4.5 Call release, PT interface........................................................................................ 30
3.3.4.4.6 Call release, FT interface........................................................................................ 30
3.3.4.5 Data Transmission ............................................................................................................ 31
3.3.4.5.1 Alignment with call control ...................................................................................... 31
3.3.4.5.2 Usage of modem lead signals................................................................................. 31
3.3.4.5.3 Escaping to configuration mode.............................................................................. 31
3.3.4.6 Example: Transparent Multipoint Mode ............................................................................ 32
3.3.4.7 Modem Lead Signals in CLDPS Mode.............................................................................. 33
3.4 Configuration Mode .......................................................................................................................... 34
3.4.1 Entering the Configuration Mode .............................................................................................. 34
3.4.2 Configuration Protocol .............................................................................................................. 34
3.4.3 Leaving the Configuration Mode............................................................................................... 34

CONTENTS
42.10 •19.01.2007
4. Configuration Commands ..................................................................................................................... 35
4.1 Configuration Command Overview................................................................................................... 35
4.2 Return Codes.................................................................................................................................... 39
4.3 Argument Formats ............................................................................................................................ 40
4.4 Configuration Commands Reference ............................................................................................... 41
4.4.1 Hardware Commands ............................................................................................................... 41
4.4.1.1 All hardware parameters: GHALL ..................................................................................... 41
4.4.1.2 Module type: GHTY........................................................................................................... 41
4.4.1.3 Relative rssi value: GHRSSI ............................................................................................. 42
4.4.1.4 Calibrated RSSI Value GHRSSIC..................................................................................... 42
4.4.1.5 Receive quality: GHQUAL................................................................................................. 43
4.4.1.6 Flash memory type: GHFL ................................................................................................ 43
4.4.1.7 Antenna: SPANT / GPANT ............................................................................................... 44
4.4.2 Software-ID Commands............................................................................................................ 45
4.4.2.1 Software versioning parameters: GSALL.......................................................................... 45
4.4.2.2 Firmware build: GSNR ...................................................................................................... 45
4.4.3 Module Commands................................................................................................................... 46
4.4.3.1 Module parameters: GMALL ............................................................................................. 46
4.4.3.2 Module frequency: GMF....................................................................................................46
4.4.3.3 Module bandgap: GMBG .................................................................................................. 47
4.4.3.4 Module modulation: GMM ................................................................................................. 47
4.4.4 Mode Commands...................................................................................................................... 48
4.4.4.1 Protocol mode flag: SPPR / GPPR ................................................................................... 48
4.4.4.2 Value of radio test mode: SPCTR / GPCTR ..................................................................... 49
4.4.4.3 Value of CLDPS flag: SPCLDPS / GPCLDPS .................................................................. 50
4.4.4.4 Multipoint flag: SPMP / GPMP .......................................................................................... 51
4.4.4.5 Point-to-Point Protocol flag: SPPP / GPPP....................................................................... 52
4.4.5 TCP/IP Configuration Commands ............................................................................................ 53
4.4.5.1 TCP/IP stack: SPTCP / GPTCP........................................................................................ 53
4.4.5.2 TCP/IP mode: SPTCPMODE / GPTCPMODE ................................................................. 54
4.4.5.3 Own IP address: SPIPAD / GPIPAD................................................................................. 55
4.4.5.4 Own active IP address: GSIPAD....................................................................................... 55
4.4.5.5 IP netmask: SPIPNM / GPIPNM ....................................................................................... 56
4.4.5.6 Active IP netmask: GSIPNM ............................................................................................. 56
4.4.5.7 IP gateway: SPIPGW / GPIPGW ...................................................................................... 57
4.4.5.8 Active IP gateway: GSIPGW............................................................................................. 57
4.4.5.9 TCP Host Address: SPTCPHOST / GPTCPHOST........................................................... 58
4.4.5.10 TCP Port number: SPTCPPORT / GPTCPPORT............................................................. 58
4.4.5.11 DHCP mode: SPDHCP / GPDHCP................................................................................... 59
4.4.6 Info Commands......................................................................................................................... 60
4.4.6.1 Serial number parameters: GNALL................................................................................... 60
4.4.6.2 European manufacturer: GNEMC ..................................................................................... 60
4.4.6.3 MAC address: GNETH...................................................................................................... 61
4.4.6.4 DECT serial number: GNDNR .......................................................................................... 61
4.4.6.5 Production serial number: GNSER ................................................................................... 61
4.4.6.6 Unit number: GNUNR........................................................................................................ 62
4.4.7 Identity Commands ................................................................................................................... 62
4.4.7.1 Air subscription accept: SIAIR / GIAIR.............................................................................. 62
4.4.7.2 Air subscription identified by PARK: SISUA / SISUB / SISUD / GISUB / DISUB ............. 63
4.4.7.3 Subscription key: GISK ..................................................................................................... 66
4.4.7.4 Identity PIN: SIPIN ............................................................................................................ 67
4.4.7.5 Subscription master key: SISMK....................................................................................... 67
4.4.7.6 PARK of FT: GIPARK........................................................................................................ 67
4.4.7.7 Access rights identity: SIARI / GIARI / DIARI ................................................................... 68
4.4.8 Voice Commands...................................................................................................................... 69
4.4.8.1 Voice microphone parameters: SPVMIC/ GPVMIC .......................................................... 69
4.4.8.2 Voice mode flag: SPVOICE / GPVOICE ........................................................................... 70
4.4.8.3 Voice speaker: SPVSPE / GPVSPE ................................................................................. 71
4.4.8.4 Voice sidetone: SPVST / GPVST...................................................................................... 72
4.4.9 Serial and IO Commands.......................................................................................................... 72
4.4.9.1 Baud rate SPBD / GPBD / IPBD ....................................................................................... 72

PREFACE
About this Document
2.10 •19.01.2007 5
4.4.9.2 Serial communication: SPCOM / GPCOM ........................................................................ 73
4.4.9.3 Parameter call control: SPCC / GPCC.............................................................................. 74
4.4.9.4 Enhanced call control: SPECC / GPECC.......................................................................... 75
4.4.9.5 User interface: SPUI / GPUI..............................................................................................76
4.4.10 Other Configuration Commands ............................................................................................... 77
4.4.10.1 Configurable parameters: GPALL ..................................................................................... 77
4.4.10.2 Type of DECT termination: SPTM / GPTM ....................................................................... 78
4.4.10.3 Dial string internal: SPDSI / GPDSI / DPDSI .................................................................... 79
4.4.10.4 Dial string default: SPDSD / GPDSD / DPDSD ................................................................ 80
4.4.10.5 Customer string: SPCUST / GPCUST / DPCUST ............................................................ 81
4.4.10.6 Location flag: SPLOC / GPLOC ........................................................................................ 82
4.4.10.7 Parameter sync. windows: SPSYWD / GPSYWD ............................................................ 83
4.4.10.8 DPSCFG command ..........................................................................................................84
4.4.10.9 Retry value: SPRETRY / GPRETRY / DPRETRY ............................................................ 85
4.4.10.10 Timeout value: SPTIMEOUT / GPTIMEOUT / DPTIMEOUT............................................ 87
4.4.11 General Commands.................................................................................................................. 89
4.4.11.1 All data: GALL ................................................................................................................... 89
4.4.11.2 Firmware diagnostics: CRC .............................................................................................. 90
4.4.11.3 Result code Ok: GOK........................................................................................................ 90
4.4.11.4 Exit configuration mode: EXIT...........................................................................................90
5. Appendix ................................................................................................................................................. 91
5.1 Protocol Data Mode .......................................................................................................................... 91
5.1.1 General Description .................................................................................................................. 91
5.1.2 Usage of RS-232 Interface ....................................................................................................... 93
5.1.2.1 Connection of the interface ............................................................................................... 93
5.1.2.2 Interface parameters ......................................................................................................... 93
5.1.3 HDLC Frame Structure ............................................................................................................. 93
5.1.3.1 Flag field (FLAG) ............................................................................................................... 93
5.1.3.2 Address field (ADDR) ........................................................................................................ 94
5.1.3.3 Control field (CTRL) .......................................................................................................... 94
5.1.3.4 Data field (DATA) .............................................................................................................. 95
5.1.3.5 Frame check sequence (FCS) .......................................................................................... 95
5.1.4 HDLC Procedures..................................................................................................................... 95
5.1.4.1 Multiplexing of LAP channels ............................................................................................ 95
5.1.4.2 Transparency .................................................................................................................... 96
5.1.5 LAP Protocol Overview ............................................................................................................. 97
5.1.6 LAP Information Elements ........................................................................................................ 98
5.1.6.1 Information frames ............................................................................................................ 99
5.1.6.2 Supervisory frames RR, RNR and REJ ............................................................................ 99
5.1.6.3 Supervisory frames SABM and UA ................................................................................... 99
5.1.6.4 Information elements in the ADDR field.......................................................................... 100
5.1.7 LAP Procedures ...................................................................................................................... 101
5.1.7.1 States .............................................................................................................................. 101
5.1.7.2 Conditions ....................................................................................................................... 101
5.1.7.3 Timers ............................................................................................................................. 102
5.1.7.4 Sequence variables......................................................................................................... 102
5.1.7.5 Sender procedures.......................................................................................................... 103
5.1.7.6 Receiver Procedures....................................................................................................... 104
5.1.7.7 Establishment.................................................................................................................. 105
5.1.7.8 Termination ..................................................................................................................... 105
5.1.7.9 Re-establishment ............................................................................................................ 105
5.1.8 SDL Representation of LAP.................................................................................................... 106
5.1.9 Call Control Information Elements .......................................................................................... 115
5.1.9.1 General Description......................................................................................................... 115
5.1.9.2 ConnectInd Command .................................................................................................... 116
5.1.9.3 DisconnectInd Command................................................................................................ 117
5.1.9.4 ConnectReq Command................................................................................................... 118
5.1.9.5 DisconnectReq Command .............................................................................................. 118
5.1.9.6 LocationInd Command .................................................................................................... 119
5.1.9.7 LocationRes Command................................................................................................... 120

CONTENTS
62.10 •19.01.2007
5.1.10 Call Control Procedures.......................................................................................................... 121
5.1.10.1 Incoming Call................................................................................................................... 121
5.1.10.2 Outgoing Call................................................................................................................... 121
5.1.10.3 Call Release, Host initiated ............................................................................................. 121
5.1.10.4 Call Release, PT initiated................................................................................................ 121
5.1.11 API of the dectprot.dll.............................................................................................................. 122
5.1.11.1 DECT_CALLBACK_FUNC_T ......................................................................................... 122
5.1.11.2 DectInit ............................................................................................................................ 123
5.1.11.3 DectDestroy..................................................................................................................... 123
5.1.11.4 DectRegisterCallback...................................................................................................... 123
5.1.11.5 DectOpen ........................................................................................................................ 123
5.1.11.6 DectClose ........................................................................................................................ 124
5.1.11.7 DectRead ........................................................................................................................ 124
5.1.11.8 DectWrite......................................................................................................................... 124
5.1.11.9 DectConnectReq ............................................................................................................. 125
5.1.11.10 DectDisconnectReq......................................................................................................... 125
5.1.11.11 DectGetConnStatus ........................................................................................................ 125
5.1.11.12 DectGetLineStatus .......................................................................................................... 126
5.1.11.13 DectGetIpui ..................................................................................................................... 126
5.1.11.14 DectGetBytesAvail .......................................................................................................... 126
5.1.11.15 DectGetTxFree................................................................................................................ 126
5.1.11.16 DectGetTxPending .......................................................................................................... 127
5.1.11.17 DectLapStateCfm ............................................................................................................ 127
5.1.11.18 DectLocationRes ............................................................................................................. 127
5.1.11.19 DectSwitchRoaming ........................................................................................................ 128
5.1.11.20 DectSwitchLocation......................................................................................................... 128
5.1.11.21 DectLapStateGetLen....................................................................................................... 128
5.1.11.22 DectLapStateGetIpui ....................................................................................................... 129
5.1.11.23 DectLapStateGetCallNr................................................................................................... 129
5.1.11.24 DectBuildIpuiTypeN......................................................................................................... 129
5.1.11.25 DectReadTo .................................................................................................................... 130
5.1.11.26 DectWriteTo .................................................................................................................... 130
5.2 Configuration of PPP Connections ................................................................................................. 131
5.2.1 Dial-up Options ....................................................................................................................... 131
5.2.1.1 AT Commands ................................................................................................................ 131
5.2.1.2 Microsoft Direct Link........................................................................................................ 131
5.2.2 PPP Options............................................................................................................................ 131
5.2.3 DHCP available....................................................................................................................... 131
5.2.4 DHCP not available................................................................................................................. 131
5.3 Serial Bus Protocol ......................................................................................................................... 132
5.3.1 Introduction ............................................................................................................................. 132
5.3.2 Architecture ............................................................................................................................. 132
5.3.3 CLDPS .................................................................................................................................... 133
5.3.3.1 Addressing ...................................................................................................................... 133
5.3.3.2 Functionality .................................................................................................................... 133
5.3.3.3 Registration to a Base Station......................................................................................... 133
5.3.3.4 Ethernet Interworking ...................................................................................................... 134
5.3.4 Implementation ....................................................................................................................... 134
5.3.4.1 Addressing ...................................................................................................................... 134
5.3.4.2 Ethernet Frame Structure................................................................................................ 135
5.3.4.3 Format at the serial Interface .......................................................................................... 135
5.3.4.4 Transparency .................................................................................................................. 136
5.4 Voice Mode..................................................................................................................................... 137
5.4.1 Block Diagram......................................................................................................................... 137
5.4.2 Advises on Voice Commands................................................................................................. 137
5.5 Download Protocol.......................................................................................................................... 138
5.5.1 Pass one ................................................................................................................................. 138
5.5.2 Pass two.................................................................................................................................. 139
5.5.3 Computation of CRC............................................................................................................... 140
6. Abbreviations........................................................................................................................................ 141

PREFACE
About this Document
2.10 •19.01.2007 7
1. Preface
1.1 About this Document
HW 86012 and HW 86022 are delivered together with Höft & Wessel DECT firmware. The
firmware is described within this document.
For hardware-related information please see the HW 86012/22 Integration Manual.
1.2 Contact Höft & Wessel AG
For immediate assistance please address yourself to the Höft & Wessel service line:
Telephone: [phone]
Telefax: [phone]
Email: [e-mail]
If you have general questions concerning Höft & Wessel communication products you may
directly contact the communications department:
Telephone: [phone]
Telefax: [phone]
Email: [e-mail]
Latest revisions of all publicly available documentation and firmware downloads are available
from our web-site www.hoeft-wessel.de
Höft & Wessel AG
Rotenburger Strasse 20
D-30659 Hannover
Germany

PRODUCT OVERVIEW
General Description
82.10 •19.01.2007
2. Product Overview
The DECT transceiver module HW 86012 and the Frequency Hopping Spread Spectrum
(FHSS) transceiver module HW 86022 are highly versatile and powerful engines for popular
and advanced DECT / FHSS applications. They provide both RF and baseband signal
processing as well as a complete protocol stack and allow for data and voice transmission.
2.1 General Description
The protocol stack has been implemented as firmware running on the micro controller of the
HW 86012/22. It comprises the DECT protocol layers MAC (EN 300 175-3), DLC (EN 300
175-4) and NWK (EN 300 175-5). Data service is provided according to the DSP C.1/C.2
profile based on LU3 connection. It offers payload data rates of 26 kbit/s in point-to-point
applications and up to four times 26 kbit/s in point-to-multipoint applications.
Aditionally the CLDPS (Connection-Less DECT Packet System) protocol is implemented. It
offers connection-less, packed based data transmission on DECT with payload data rates of
500 kBit/s per radio cell. A base station allocates up to 12 DECT channels (time / frequency
multiplexing) and uses a dedicated slot format. The capacity can dynamically be shared
between the subscribed portables according to the actual demand. CLDPS allows 64
simultaneously connected portables and therefore is capable to support even large wireless
networks.
Based on CLDPS lower layer protocol, an TCP/IP stack is implemented. This allows PT
mode modules to operate with CLDPS base stations (such as HW 8614 Ethernet Base
Station) using TCP/IP protocol.
Data-Unwired embedded DECT / FHSS modules support both connection-based DECT and
packet-based CLDPS, which can be configured by software.

PRODUCT OVERVIEW
General Description
2.10 •19.01.2007 9
Comparison of both protocols:
Characteristic Connection based Packet based (CLDPS)
Networking capability no1yes, 64 active subscribers per
radio cell (= base station)
TCP/IP capability no yes
Data rate 2x26 kBit/s for up/downlink,
synchronous
up to 500 kBit/s per radio cell,
asynchronous
Symmetry up/downlink symmetrical asymmetrical, dynamical
Occupied DECT channels 1 duplex 12 duplex per radio cell
Real-time capabilities data are transferred in fixed 10 ms
time frame
allocation of timeslots by base
station,
not collision-based,
9 traffic slots per 10ms time
frame,
undetermined behaviour with
increasing number of
subsribers and amount of data
Voice transmission yes, between FT and one PT, input
via microphone, output to
loudspeaker at the other side
no2
The FHSS protocol stack of the HW 86022 further additionally includes the MAC layer
procedures related to frequency hopping which is required for operation in the 2.4 GHz ISM
band.
Moreover the firmware includes full interworking with the RS-232 interface.
Note: Earlier firmware versions supported a high-speed point-to-point mode. Due to the
development of CLDPS Höft & Wessel devices will no longer support this mode.
1present 1:4 protocol mode further supported but not recommend for new projects.
2packet based voice transmission possible

PRODUCT OVERVIEW
Summary of Features
10 2.10 •19.01.2007
2.2 Summary of Features
Feature Short description
Air interface HW 86012:
Compliant with DECT (EN 300 175)
HW 86022:
Compliant with FCC part 15 and EN 300 328
Protocols C-Plane according GAP (EN 300 444)
Data transmission Connection Orientated: According DSP C.2
(EN 300 651)
Connection-Less: CLDPS
Point-to-multipoint Connection Orientated: up to 4 simultaneous connections
(4x26 kBit/s) (EN 300 651)
Connection-Less: up to 64 simultaneous connections (500
kBit/s per radio cell) (CLDPS)
Small footprint Size: 53 mm x 37 mm
Versatile interfaces e.g. RS-232, PCM, I/O, I²C, voice, µC bus
Firmware upgradeable Firmware can be downloaded
Voice Voice transmission is possible
Easy configuration Configuration mode for easy installations
Easy subscription Through EasySubs technique

PRODUCT OVERVIEW
Principles of operation
2.10 •19.01.2007 11
2.3 Principles of operation
2.3.1 DECT Network Entities
HW 86012 employs radio transmission according to the international DECT standard on 1.9
GHz. It is compliant with the air interface standard EN 300 175. HW 86022 uses a modified
version of that standard which is compliant with FCC part 15 and EN 300 328 for DECT
operation on 2.4 GHz ISM band. The following description applies to both systems.
The DECT standard defines two communication entities: The fixed termination (FT),
commonly seen as base station, and the portable termination (PT), usually a handset.
Throughout this manual the terms “fixed” and “portable” are used in the DECT sense. This
does not preclude that a FT may change its location or a PT may be stationary mounted.
A HW 86012/22 can be configured either as PT or as FT. For the most simple case, a point-
to-point connection between two modules, one side must be configured as PT and the other
side as FT
The general architecture of any DECT system comprises one FT and a variable number of
PTs. This is called a point-to-multipoint network. The number of PTs in a network is not
limited by the DECT standard but only by implementation constraints.
Larger DECT networks often include multiple “base stations”. Strictly speaking, the DECT
network still has a single FT but this is distributed on multiple cells. Many people get
confused about that concept, because they associate “base station” and FT. Within DECT
terminology the term “base station” is not used at all, but this entity is called a “radio fixed
part” (RFP). So in any DECT system there is one FT which comprises one or multiple RFPs.
All entities are identified by DECT-internal “addresses” (for a more detailed discussion on
DECT identifiers see section 3.2.1). When installing a DECT system, every PT must learn
the identity of the FT and the FT must learn the identities of each PT. This procedure is
called subscription. Subscription defines which PTs belong to a FT. All DECT security
features (authentication and encryption) build on that mechanism. The subscription
procedure for HW 86012/22 is described in sections 3.2.3 and 3.2.4.

PRODUCT OVERVIEW
Principles of operation
12 2.10 •19.01.2007
2.3.2 Connections
A connection always involves a pair PT - FT. There are no direct connections between two
PTs.
Call control works similar to a telephone system. This means there are the following phases
during a communication:
1. A call is set up either by the calling party (can be PT or FT)
2. The call is accepted by the called party (normal case). However the system may be busy
or the called party is not ready to answer the call (exceptional case).
3. The communication channel is used for payload data
4. The call is released by any party (normal case) or by the system (exceptional case)
HW 86012/22 provides efficient methods of call control. These are described in more details
in sections 3.3.4.4 and 5.1.10.
Different types of connections are defined by the DECT standard. E.g. a data connection
differs very much from a voice connection. Most available DECT devices only support voice
connections. This explains, why it is usually not possible to send data from a HW 86012/22
to a consumer type of DECT “base station”.
Connection types supported by HW 86012/22 include data connections of type LU3 and
voice connections of type LU1. Explanations of LU1, LU3 are given in the DECT DLC layer
standard EN 300175-4.
HW 86012/22 supports advanced connection set-up including symmetric multi-bearer
connections.

FIRMWARE DESCRIPTION
Overview
2.10 •19.01.2007 13
3. Firmware description
The standard firmware contains two radio protocols:
•Connection-based single-bearer mode handles up to 4 connections at a time in point-to-
multipoint applications with payload data rates of up to 26 kBit/s per connection
•CLDPS packet based transmission mode handles up to 64 PTs operating in a radio cell
at a time in point-to-multipoint applications with payload data rates of up to 500 kbit/s per
radio cell.
3.1 Overview
All functions of the HW 86012/22 are enabled by suitable firmware. This includes the
processing of the DECT communication protocols, the control of interfaces and other
features.
3.1.1 Operation Modes
The firmware may run in any of the following operation modes:
Operation mode Purpose
Configuration mode Set-up module parameters
Data mode Data transmission using the RS-232 as interface or
voice transmission using the analog frontend or PCM.
Download mode Load the DECT module with new firmware
The data mode has the following sub-modes
Data sub-modes Purpose
Transparent data mode Transparent data transmission over RS-232 interface,
single connection endpoint
Protocol data mode Connection-based:
Multiplexed data transmission over RS-232 interface,
multiple connection endpoints.
CLDPS packet based:
Ethernet frames over RS-232.
The data sub-mode can be configured by use of the SPPR configuration command (see
section 4).
Each of the operation modes has a specific usage of the RS-232 interface. Please refer to
the descriptions of the operation modes.

FIRMWARE DESCRIPTION
Overview
14 2.10 •19.01.2007
3.1.2 Mode Selection
The operation mode can be selected either by an appropriate reset sequence or by software
escape commands. The download mode can be selected by a reset sequence or by a
download command from configuration mode.
3.1.2.1 Selection by Reset Sequence
See HW 86012/022 Integration Manual for details on the reset sequence.
If the download mode is entered, the download protocol is invoked. See section 5.5.
When the configuration mode is entered it will be executed using a baud rate of 9.600 bd.
In case the data mode is selected the RS-232 interfaces now works with the configured data
rate (default 115200 kbps).
3.1.2.2 Selection by Software Escape Sequence
A transition from configuration mode to data mode is performed without hardware reset by
use of the EXIT configuration command (see section 4).
A transition from transparent data mode to configuration mode is performed without
hardware reset by use of the +-+ escape sequence (see section 3.3.4.5.3). In this case the
configuration mode will be executed using the baud rate configured for data mode.

FIRMWARE DESCRIPTION
System Security
2.10 •19.01.2007 15
3.2 System Security
The DECT standard includes useful security functions that efficiently protect DECT systems
from hostile break-in and espionage. For details on the security features please refer to
standard EN 300 175-7.
The firmware implements security features in compliance with the GAP standard EN 300
444.
Before a PT is allowed to set-up connections to any FT it must be subscribed at that FT.
During the subscription procedure PT and FT mutually exchange their identities.
In compliance with GAP the firmware supports on-air subscription of PTs, meaning that the
subscription information is exchanged over the air interface. Through on-air subscription the
HW 86012/22 can be subscribed to DECT equipment of other manufacturers.
Offline subscription is an alternative subscription procedure that does not require any
information exchange over the air interface. This procedure is only supported by equipment
of Höft & Wessel.
Both procedures lead to equivalent results and can be used alternatively.
On each connection set-up, the FT requests an authentication from the PT. This assures that
only subscribed PTs connect to a FT.
User data is sent over the air in encrypted format. This provides effective protection from
espionage.

FIRMWARE DESCRIPTION
System Security
16 2.10 •19.01.2007
3.2.1 DECT Identities
The DECT standard defines identities for PTs and FTs that are used for mutual identification
and authentication. Standard EN 300 175-6 contains a detailed description of these
identities.
The following sub-sections contain a summary of the DECT identities and their usage.
3.2.1.1 FT related Identities
A FT is identified by an ARI (access rights identity).
According to the DECT standard a FT may own multiple ARIs, which are called PARI
(primary ARI), SARIs (secondary ARIs) and TARIs (tertiary ARIs). In accordance with the
GAP service profile (EN 300 444) HW 86012/22 supports one ARI which is then the PARI.
SARIs and TARIs are not supported.
The DECT standard allows different ARI classes. HW 86012/22 (as FT) uses most ARI class
A, but ARI class B and C are also supported. However HW 86012/22 (as PT) is
interoperable with FTs that use a different ARI class.
The ARI class A is a 36 bits wide, world-wide unique identifier. It is factory-burnt into the
module during production and cannot be modified.
However the factory-burnt ARI can be overloaded by a user-defined ARI. The administration
of multi-cell networks is simplified, if all RFPs carry the same ARI. Please see the
configuration command SIARI.
The structure of the ARI class A is shown below.
0 0 0 EMC FPN
b35 b34 b33 b32 ... b17 b16 ... b0
The three leftmost bits are always zero. This identifies ARI class A.
The EMC (ETSI manufacturer code) is a 16-bit value that has been assigned by ETSI to a
manufacturer. Höft & Wessel has assigned the EMCs 322 and 2921 (decimal).
The FPN (DECT fixed part number) is a 17-bit value that is unique in the context of an EMC.
It is assigned by the manufacturer.
Höft & Wessel uses an internal code, the DNR (DECT serial number) to uniquely identify
modules. The DNR is a 20-bit value. The FPN is derived from the DNR through integer
division by eight:
FPN = DNR div 8
In a multi-cell environment the FT consists in multiple RFPs. In a single-cell environment
there is only one RFP.
Each RFP is identified by a RFPI (radio fixed part identity). It consists in the PARI of the FT
and the RPN (radio fixed part number). The RPN is used in multi-cell networks in order to
distinguish between RFPs which have the same ARI.
RPN shall be 0 for standalone RFP (single-cell environment) and 1 to 7 for multi-cell
systems.
For more complex installations with more than 7 RFPs please contact Hoeft & Wessel for
ARI class B.

FIRMWARE DESCRIPTION
System Security
2.10 •19.01.2007 17
In order to identify allowed FTs any PT stores one PARK (portable access rights key). A
PARK corresponds to a single ARI or to a group of ARIs that only differ in their least
significant bits. The PLI (PARK length indicator) defines, how many bits of the ARI are
relevant. The default is 36, i.e. all bits are relevant.
In multi-cell networks the PARK may be selected such that it covers the ARIs of all RFPs.
When a PARK is manually entered, it is coded according to the GAP standard. The following
format is used.
•The PARK starts with two digits representing the PLI in decimal format.
•Then follow up to 12 digits representing <pli> bits of the ARI in octal format. If necessary
the bit string is padded with zeros at the right side in order to achieve octal alignment.
•Finally a check digit is entered. The check digit is calculated as the sum of each digit
multiplied by its position in the string modulo 11. The check digit lies between 0 and 10
and is represented either as the decimal digit, or as a "*" if equal to 10.
Sometimes it can be necessary to manually calculate a PARK from PLI, EMC and DNR this
is illustrated in the following example:
EMC decimal: 322 binary: 0000 0001 0100 0010
DNR decimal: 524752 FPN = DNR div 8
FPN decimal: 65594 binary: 1 0000 0000 0011 1010
PLI decimal: 23
ARI binary: 000 0000 0001 0100 0010 1 0000 0000 0011 1010
ARI(pli) binary: 000 000 000 010 100 001 010 00
octal: 00024120 (last digit padded with zero)
check 0*1+0*2+0*3+2*4+4*5+1*6+2*7+0*8= 48 modulo 11 = 4
PARK 23000241204
Note: The DNR is always a multiple of 8.
3.2.1.2 PT related Identities
A PT is identified by an IPEI (international portable equipment identity). This is a 36 bits
wide, world-wide unique identifier. It is factory-burnt into the module during production and
cannot be modified.
The structure of the IPEI is shown below.
EMC DNR
b35 ... b20 b19 ... b0
The IPEI is part of the default IPUI (international portable user identity) of type N, that is used
for identification of a PT in a DECT network. The DECT standard allows other IPUI types and
allows multiple IPUIs at a PT. HW 86012/22 (as PT) does not use IPUI types other than N.
However HW 86012/22 (as FT) is interoperable with PTs that use a different IPUI type.

FIRMWARE DESCRIPTION
System Security
18 2.10 •19.01.2007
3.2.1.3 Subscription Identities
During the subscription procedure defined in the DECT standard a UAK (user authentication
key) is created. This key represents a pair (FT, PT) and must be known by PT and FT since
it is used for the authentication procedure. When the FT requests an authentication from a
PT it tests the correct UAK.
The UAK is not entered nor transmitted over the air interface but independently computed by
FT and PT from public information which is encrypted using a secret PIN (personal identity
number) code.
This PIN code is stored at the FT and must be entered at the PT as part of the subscription
procedure.
The format of the PIN is 1 to 8 decimal digits.
Note: leading zeros in PIN codes are significant, e.g. PIN 007 is different from PIN 7.
The default PIN (factory setting) is: 0
The PIN code is entered at the FT by use of the SIPIN configuration command. System
integrators are advised to use different PINs in different installations in order to provide a
good level of security. The PIN must be entered at the first installation of a FT and can be
modified by the system operator later.
The firmware supports on-air subscription according to GAP and a proprietary offline
subscription procedure. In on-air subscription the public information is transmitted by the FT
over the air interface, whereas in offline subscription it is read out from the FT as SK
(subscription key).
The SK is an encrypted format of the UAK.

FIRMWARE DESCRIPTION
System Security
2.10 •19.01.2007 19
3.2.2 EasySubs
EasySubs is a powerful technique for handling of subscription information in the FT.
Conventional FT implementations include a table of all subscribed PTs with their UAKs.
Since memory is limited, the FT may only support a very limited number of subscriptions.
The EasySubs technique avoids storage of UAKs in the FT but provides an efficient means
for on-demand computation of UAKs from other information already available. Due to
EasySubs, FTs of Höft & Wessel support an unlimited number of PT subscriptions.
EasySubs if fully compliant with the DECT standard. It is used for both, on-air and offline
subscriptions. EasySubs is interoperable with GAP-compliant PTs of other manufacturers.
The security of the DECT system is fully preserved by EasySubs by introducing an additional
key, the SMK (subscription master key). The SMK is stored in the FT in non-volatile memory.
It is used during on-demand computation of UAKs.
Only a single SMK is needed, independent of the number of PTs to be subscribed.
The default SMK (factory setting) is: 00000000
The PT stores subscription information in the conventional way, i.e. EasySubs only affects
the FT.
In multi-cell networks all RFPs must be programmed with the same values of PIN and SMK
respectively.
A big advantage of EasySubs: Any PT must only be subscribed to a single RFP of a multi-
cell network. Then it automatically communicates with all other RFPs of that network.
Note: If the system operator modifies the values of PIN and/or SMK at his FT, all previous
PT subscriptions get invalid and must be renewed.

FIRMWARE DESCRIPTION
System Security
20 2.10 •19.01.2007
3.2.3 On-Air Subscription of Portable Terminals
The firmware supports on-air subscription according to GAP. In on-air subscription the public
information is transmitted by the FT over the air interface.
The on-air subscription procedure is described below.
Step 1 FT Enable on-air subscription by setting SIAIR ON.
Leave FT powered on.
Step 2 PT Initiate on-air subscription by issuing a SISUA command. Result
code <ok> signals successful subscription
Step 3 FT Disable on-air subscription by setting SIAIR OFF
or by leaving the configuration mode.
Air subscription also is set OFF on a reset of the FT module.
3.2.4 Offline Subscription of Portable Terminals
The firmware supports a proprietary offline subscription procedure that works without
transmitting information over the air interface. Therefore this technique is also applicable to
situations were PT and FT are physically separated during subscription.
The offline subscription procedure is described below.
Step 1 PT Perform offline subscription by issuing a SISUD command.
Result code <ok> signals successful command execution. This
does not imply that the subscription itself was successful (e.g.
PIN could be incorrect)