Radio Bridge RBM101 User manual

Radio Bridge RBM101
User Guide
VERSION 0.1
APRIL 2017

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 1OF 35
TABLE OF CONTENTS
1. RADIO BRIDGE RBM101 USER GUIDE ....................................................................................... 4
1.1. About this Guide ........................................................................................................................4
1.2. Revision History .........................................................................................................................4
1.3. Document Conventions ..............................................................................................................4
1.4. Part Numbering..........................................................................................................................5
2. THE SUBGIG™ STANDARD......................................................................................................... 5
3. TECHNICAL SPECIFICATIONS..................................................................................................... 5
3.1. Performance Specifications.........................................................................................................5
3.2. General Specifications ................................................................................................................6
3.3. Power Requirements..................................................................................................................6
3.4. Pin Signals..................................................................................................................................7
4. SERIAL COMMANDS ................................................................................................................. 8
4.1. Commands to the Module ..........................................................................................................8
4.2. Messages from the Module ........................................................................................................9
4.2.1. “CMD”: Command Response .................................................................................................... 9
4.2.2. “ERR”: Error Message................................................................................................................ 9
4.2.3. “STA”: Status Message.............................................................................................................. 9
4.2.4. “SNF”: Sniffer ..........................................................................................................................10
4.2.5. “APP”: Application Payload.....................................................................................................10
4.3. AT Command Reference ...........................................................................................................10
4.3.1. AT Commands .........................................................................................................................10
4.3.1.1 SP - Send Packet..................................................................................................................10
4.3.1.2 EP –Emergency Packet ....................................................................................................... 11
4.3.1.3 WR –Write Configuration...................................................................................................11
4.3.1.4 RE –Restore Parameters.....................................................................................................11
4.3.1.5 FR –Factory Reset............................................................................................................... 11
4.3.1.6 DI –Device ID ......................................................................................................................11
4.3.1.7 VI –Vendor ID ..................................................................................................................... 12
4.3.1.8 Enter Bootloader.................................................................................................................12
4.3.1.9 BT –Bootloader Timeout ....................................................................................................12
4.3.1.10 AE –Add Endpoint.......................................................................................................... 12
4.3.1.11 DE –Discover Endpoint ..................................................................................................12
4.3.1.12 BI –Broadcast ID ............................................................................................................13

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 2OF 35
4.3.1.13 BO –Broadcast ID Only .................................................................................................. 13
4.3.1.14 LI –List IDs......................................................................................................................13
4.3.1.15 RI –Remove ID ...............................................................................................................14
4.3.1.16 CE –Coordinator enable.................................................................................................14
4.3.1.17 SM –Sleep mode............................................................................................................14
4.3.1.18 LW –Listen Window.......................................................................................................14
4.3.1.19 QP - Queue Packet..........................................................................................................15
4.3.1.20 ST –Supervisor Timeout.................................................................................................15
4.3.1.21 EE –Encryption enable...................................................................................................15
4.3.1.22 PK –Provisioning Key .....................................................................................................16
4.3.1.23 SK –Session Key .............................................................................................................16
4.3.1.24 KU –Send Upper Half of Session Key ............................................................................. 17
4.3.1.25 KL –Send Lower Half of Session Key .............................................................................. 17
4.3.1.26 SV –SubGig stack version...............................................................................................17
4.3.1.27 VR –Firmware version ................................................................................................... 17
4.3.1.28 HR –Hardware version................................................................................................... 17
4.3.1.29 DB –RSSI of last packet ..................................................................................................18
4.3.1.30 EA –Number of ack failures ...........................................................................................18
4.3.1.31 OS –Number of out of sequence packets......................................................................18
4.3.1.32 RD –Device type.............................................................................................................18
4.3.1.33 PL –Power Level............................................................................................................. 18
4.3.1.34 RP –Reduce Power Level ...............................................................................................19
4.3.1.35 TC –Test carrier.............................................................................................................. 19
4.3.1.36 TP –Test packets............................................................................................................19
4.3.1.37 SN –Sniffer Mode...........................................................................................................19
4.3.1.38 BR –Baud Rate ...............................................................................................................20
4.3.1.39 DF –Duplicate Filter .......................................................................................................20
5. MESSAGES.............................................................................................................................. 21
5.1. Status Messages.......................................................................................................................21
5.2. Error Messages.........................................................................................................................21
6. CONFIGURATION.................................................................................................................... 25
6.1. Sleep Mode Configuration ........................................................................................................25
6.1.1. Waking up from Sleepy Endpoint ...........................................................................................25
6.1.1.1 SLEEP_RQ input pin pulled low ...........................................................................................25
6.1.1.2 Supervisory Message time expires......................................................................................25
6.1.2. Using Pins to Control Sleep Mode ..........................................................................................26
6.2. Supervisor Configuration ..........................................................................................................26
6.2.1. Supervisory Messages Period .................................................................................................26

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 3OF 35
6.2.2. Supervisory Messages Occurrence .........................................................................................27
6.3. Security and Encryption............................................................................................................27
6.3.1. Session Key..............................................................................................................................27
6.3.2. Provisioning Key......................................................................................................................27
6.3.3. Encryption Requirements .......................................................................................................27
6.3.4. Using session keys directly with no key broadcast ................................................................. 28
6.3.5. Broadcasting session key in the field ......................................................................................28
6.3.6. Sequence Number in Packets .................................................................................................28
6.4. Sniffer Mode ............................................................................................................................29
6.4.1. Setting Device to Sniffer Mode ............................................................................................... 29
6.4.2. SNF Fields ................................................................................................................................29
6.4.2.1 Time Stamp .........................................................................................................................29
6.4.2.2 Device Type.........................................................................................................................29
6.4.2.3 Device ID .............................................................................................................................29
6.4.2.4 Sequence Number...............................................................................................................30
6.4.2.5 Encryption ...........................................................................................................................30
6.4.2.6 Command............................................................................................................................30
6.4.2.7 Payload................................................................................................................................ 30
6.5. Bootloader...............................................................................................................................30
6.5.1. Using Terminal Emulators....................................................................................................... 30
7. FCC LIMITATIONS ................................................................................................................... 32
7.1.1. FCC Part 15.231.......................................................................................................................32
7.1.2. Governor .................................................................................................................................32
8. MECHANICAL DRAWINGS....................................................................................................... 34
9. TRADEMARKS AND COPYRIGHT.............................................................................................. 35
10. DISCLAIMERS, WARRANTY, AND CUSTOMER SUPPORT....................................................... 35
10.1.1. Disclaimers ..............................................................................................................................35
10.1.2. Warranty .................................................................................................................................35
10.1.3. Customer Support................................................................................................................... 35

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 4OF 35
1. RADIO BRIDGE RBM101 USER GUIDE
1.1. About this Guide
The BridgeBee modules designed and manufactured by Radio Bridge provide wireless
connectivity for Internet of Things (IoT) applications. The RBM101 BridgeBee module
described in this document is an implementation of the SubGig standard, and can not only
achieve thousands of feet of range but also penetrate buildings and other structures much
better than higher frequency ISM bands. This document provides guidelines for configuring
and using the RBM101 module.
1.2. Revision History
Revision
Date
Description
1.0
May 2017
Initial release of the document
1.3. Document Conventions
Font / Icon
Meaning
Courier New
Command line input/output
Notes
Important information

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 5OF 35
1.4. Part Numbering
Table 1 RBM101S-315S Part Numbers
Part Number
Description
RBM101S-315ST
315MHz SubGig BridgeBee through hole
RBM101S-315SS
315MHz SubGig BridgeBee surface mount
2. THE SUBGIG™STANDARD
The SubGig™specification defines a simple and easy to use protocol to be used at very low
frequency non-ISM bands (such as 315MHz) for basic monitoring and control applications. The
purpose of operating at very low frequency (non-ISM) bands is to maximize range and minimize
power consumption. The RBM101 BridgeBee module described in this document is an
implementation of the SubGig™standard, and can not only achieve thousands of feet of range
but also penetrate buildings and other structures much better than higher frequency ISM bands
while consuming minimal power. The tradeoff in loss of available bandwidth is acceptable for
most sensing and control applications since most IoT devices have very low data rates.
The Federal Communications Commission (FCC) in the United States allows for basic monitoring
and control at these low frequency bands as long as a number of limitations are maintained. The
SubGig™protocol is designed to work within that framework and create a path for FCC
certification of the final product.
The RBM101 uses the SubGig™ protocol “under the hood” and references to the specification in
this document are on an as-needed basis. Although the SubGig™ protocol is designed to be very
simple and easy to use, much of the protocol is abstracted in and hidden in the RBM101 for ease
of use. For more information, please see the published SubGig™specification.
3. TECHNICAL SPECIFICATIONS
3.1. Performance Specifications
The following table provides the performance specifications of the RBM101.
Table 2 RBM 101 Performance Specifications
Specification
Value

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 6OF 35
Indoor / urban environment range
Outdoor / line of site range
Transmit power
RF data rate
38,400 bps
Receiver sensitivity
3.2. General Specifications
The following table provides the general specifications for the RBM101.
Table 3 General Specifications
Specification
Value
Operating Frequency
315MHz
Channels
1 (channel 0)
Operating temp
-40 to 85° C
Antenna options
SMA, u.FL
3.3. Power Requirements
The following table provides the power requirements for the RBM101.
Table 4 Power Requirements
Specification
Value
Supply voltage
2.7-3.6V
Transmit current
Receive / idle current
Sleep current
2.8uA

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 7OF 35
3.4. Pin Signals
The following table shows the pin assignments for the RBM101.
Table 5 Pin Assignments
Pin
Name
Direction
Function
1
Vcc
-
Power supply
2
UART_TX
Out
UART data out
3
UART_RX
In
UART data in
4
Broadcast_ID
In
Broadcast the device ID when held low
5
nReset
In
Device is reset when held low
6
D0
Both
Future use
7
N/C
-
Not connected
8
N/C
-
Not connected
9
Sleep_Request
In
Sleep mode is requested when held low
10
GND
-
Ground
11
D1
Both
Future use
12
D2
Both
Future use
13
nSleep
Out
Low when device is in sleep mode
14
N/C
-
Not connected
15
D3
Both
Future use
16
D4
Both
Future use
17
D5
Both
Future use
18
D6
Both
Future use
19
D7
Both
Future use
20
N/C
-
Not connected

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 8OF 35
4. SERIAL COMMANDS
The Radio Bridge modules utilize the UART serial port for communicating payload data between
modules and for configuration of the modules themselves.
The serial port runs with these default settings.
Table 6 Serial Command Default Settings
Name
Default Setting
Baud Rate
9600
Stop Bits
1
Parity
None
The baud rate can be changed using the BD AT command as defined in the AT Commands section.
All values through the serial command interface are coded as ASCII characters. In other words,
the hex value 0x12 would be coded as the ASCII string “12” which allows for convenient control
through a terminal emulator. Host processors communicating to the module through a UART
must convert values to ASCII-coded values.
4.1. Commands to the Module
Every command to the module starts with the ASCII characters “AT” which stand for
“attention” as shown in the following command structure.
Table 7 Module Command Structure
“AT” Prefix
ASCII Command
Parameters (if necessary)
Carriage Return 0x0D
2 bytes
2 bytes
0-n bytes
1 byte
These “AT” commands are defined in AT Command Reference section.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 9OF 35
4.2. Messages from the Module
The messages from the device do not have an “AT” prefix but have the following structure:
Table 8 Module Messages Structure
Message Type
Space 0x20
Message
Carriage Return 0x0D
3 bytes
1 byte
2-n bytes
1 byte
The message types are one of the following ASCII-coded values:
•“CMD”: Command Response
•“ERR”: Error Message
•“STA”: Status Message
•“SNF”: Sniffer
•“APP”: Application Payload
4.2.1. “CMD”: Command Response
Response from a previous AT command. For example, for AT commands that set valid
parameters the host would expect the response:
CMD OK
If the AT command is requesting the firmware version which happens to be v1.01 the
response would be:
CMD 0101
4.2.2. “ERR”: Error Message
This is an error message from the module that sends a 4-digit error code as ASCII coded hex
characters. For instance, error code 0x0000 would be represented by:
ERR 0000
Some error messages have an associated Device ID, and if this is the case then the error code
would be followed by the Device ID. For example, the status message for an out-of-sequence
message for Device ID 12345678 would be:
ERR 0002 12345678
See the Error Messages section for more detail.
4.2.3. “STA”: Status Message
This is general status message from the module that sends a 4-digit status code as ASCII coded
hex characters. For instance, status message 0x0000 would be represented by:
STA 0000

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 10 OF 35
Some status messages have an associated Device ID, and if this is the case then the status
code would be followed by the Device ID. For example the status message for a sleepy
supervisory message for Device ID 12345678 would be:
STA 0001 12345678
4.2.4. “SNF”: Sniffer
When the device is put into sniffer mode using the SN AT command, the device will report all
packets it sees broadcast on the SubGig protocol. All of these packets that have been “sniffed”
from the air are displayed with this prefix. See the Sniffer Mode section for more detail.
4.2.5. “APP”: Application Payload
Wireless user payload data received from a remote module. If the device is configured as an
endpoint then this would be user payload data from the coordinator, and if the device is
configured as a coordinator then this would be user payload data from an endpoint.
If a device is a coordinator and receiving data from an endpoint, then the first 32-bits (8 ASCII
coded hex characters) of this message will be the Device ID of the data source.
4.3. AT Command Reference
This section defines the serial AT commands that can be sent to the module.
4.3.1. AT Commands
All AT commands begin with an ASCII “AT”, followed by a two ASCII character command, and
followed by optional parameters depending on the command. The prefix “AT” can be used
standalone to determine if a device is available, out of reset, boot-loading complete and
responding. Upon sending “AT” with no additional command or payload, the device should
respond “CMD OK” if it is alive. This command may be used during a system boot-loading
process where a bootloader delay is used to determine if the device is ready.
4.3.1.1 SP - Send Packet
This is the basic command during normal operation to send a data payload from one module
to another. This command is used by both the coordinator sending data to an endpoint and
by an endpoint sending data to the coordinator.
Note that status messages do not include errors. For errors see the message
type Error Message. See the Status Messages section for more detail.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 11 OF 35
When this command is sent to the coordinator, the first eight ASCII characters contain the 32-
bit Device ID of the endpoint it is sending the payload to, and the next 8 bytes are the 64-bit
payload.
If the Device ID is “FFFFFFFF”, this is the reserved address which broadcasts to all endpoints.
This broadcast is a weak command in that the endpoints will not provide an ack and the out-
of-sequence check is not performed. Thus, usage of this broadcast address is not
recommended when high reliability of the message is required.
When used by the endpoint, only the 8-byte / 64-bit payload is sent as the coordinator does
not need to be addressed.
4.3.1.2 EP –Emergency Packet
This command is the same as the SP Send Packet AT command with the exception that it is
not subject to the Governor. When the governor is engaged, the normal Send Packet
command will return an error and will not transmit. However, even when the governor is
engaged the emergency packet will still transmit. The EP AT command should only be used
for conditions regarding physical safety such as intruder alarms, fire alarms, personal
emergency response systems, etc. See the section Governor for more detail.
4.3.1.3 WR –Write Configuration
Writes current configuration to non-volatile memory and loaded automatically after next
reset.
4.3.1.4 RE –Restore Parameters
Restore parameters to factory reset defaults. However, the default values are not written to
flash.
4.3.1.5 FR –Factory Reset
Factory reset the device. Resets all parameters and clears non-volatile memory and writes the
defaults to flash.
4.3.1.6 DI –Device ID
Read the 32-bit device ID for module. This is set at the factory and serves as a unique serial
number for the device. The parameters are ASCII coded hex characters. For example, a Device
ID of 0x12345678 would be represented by the string “12345678”.
This value cannot be changed. Only the factory programmed Device ID is returned.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 12 OF 35
4.3.1.7 VI –Vendor ID
Set 32-bit optional Vendor ID for the module. This is set to 0 at the factory and should be set
to the 32-bit vendor ID assigned by the SubGig Alliance. The purpose of the Vendor ID is to
define industry-specific user payloads to allow for interoperability within an industry. The
Vendor ID is optional and does not need to be set for normal operation.
The parameters are ASCII coded hex characters. For example, a Vendor ID of 0x12345678
would be represented by the string “12345678”. If no parameters are provided in the
command, the Vendor ID is returned.
4.3.1.8 Enter Bootloader
This command will stop normal program execution and jump to the bootloader. A new menu
will appear with the same serial port settings that will allow the user to load a new signed and
encrypted firmware image through the XMODEM protocol. From the bootloader there will be
a menu option to run the new firmware image and jump back to normal program execution.
It is recommended to use the Radio Bridge configuration app for firmware updates.
4.3.1.9 BT –Bootloader Timeout
This command changes the time that the bootloader waits for the <DEL> character prior to
booting the application. The parameter is a 4 digit ASCII coded hex value and is in units of
milliseconds:
Default: 0BB8 for 3 seconds
Range: 0000 to 0BB8
If the range is set to 0, the bootloader will automatically run the application at reset and the
only way to enter the bootloader is to drive the BTL pin to ground. See the Bootloader section
for more detail.
4.3.1.10 AE –Add Endpoint
Command to coordinator to manually add an endpoint to the list of connected devices. The
parameter after AE is the 32-bit Device ID of the endpoint represented as ASCII coded hex
characters. For example, a Device ID of 0x12345678 would be represented by the string
“12345678”.
Note that each system is limited to 255 endpoints and this command will return with an error
if that number is exceeded.
4.3.1.11 DE –Discover Endpoint
Command to coordinator to find the next ID sent over the wireless link and automatically add
it to the list of connected endpoints. This command should be followed by a broadcast ID (BI)
command or a sensor event transmission from an endpoint.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 13 OF 35
This command causes the coordinator to listen for 8 seconds and then timeout with an error
message if no new Device IDs are received. If any new commands are sent during the 8 second
window they will be rejected with an error message. The coordinator will only respond to the
first endpoint that it hears. If another learned or unlearned sensor transmits first before your
intended endpoint that you are trying to learn, the coordinator will accept an endpoint that
is not already in the list. If the endpoint is already in the list, the process will complete and
not add the duplicate ID to the list.
If a non-desired endpoint is accidentally heard before your desired endpoint, the endpoint ID
will need to be manually removed from the coordinator’s ID list using the Remove ID (RI)
command. The entire list of approved IDs can be seen using the List ID (LI) command
Since the DE command is vulnerable to accepting non-desired endpoints into the list, for high
environments that have many actively transmitting SubGig sensors, it may be more desirable
to use the Add Endpoint (AE) command to manually add endpoint IDs.
4.3.1.12 BI –Broadcast ID
Command to an endpoint to broadcast its Device ID so it can be read by a coordinator. This
command should come after a discover endpoint (DE) command at the coordinator and used
to associate the endpoint with the coordinator.
Taking the BID pin of the module low will create the same broadcast as this command. This is
often connected to a push-button for endpoints that do not have a host processor to issue AT
commands at endpoints. If the BID pin is used instead of the BI AT command, it must be
asserted low for at least 100ms before the Broadcast ID message is sent and it cannot be sent
again for another one second. There is no such limitation on the BI AT command.
4.3.1.13 BO –Broadcast ID Only
In the Discover Endpoint (DE) process, you may want to allow devices only issuing BI
commands or also allow for general Endpoint event transmissions to allow a coordinator to
learn in a new endpoint. The (BO) command allows control if only BI commands can be used
for the DE process or BI and sensor events. The payload for the ATBO command is as follows:
“0”: The coordinator DE process will accept BI commands or sensor events for learning
endpoints
“1”: The coordinator DE process will only accept BI commands for adding new endpoints
Default is “0”.
4.3.1.14 LI –List IDs
Command to coordinator to list the IDs of all registered endpoints. Each ID comes back in its
own individual response message which are all sent back to back for the entire list. For
example, if the two IDs are “12345678” and “24681012”, then the responses would be:

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 14 OF 35
CMD 12345678
CMD 24681012
CMD OK
If the device is not configured as a coordinator, then the module will return an error.
4.3.1.15 RI –Remove ID
Command to coordinator to remove an endpoint. Argument is an ASCII-coded 32-bit Device
ID. For example, a Device ID of 0x12345678 would be represented by the string “12345678”.
If the Device ID does not exist in the list then the module will return an error.
4.3.1.16 CE –Coordinator enable
Tells the device to act as the network coordinator. The following parameter is one of the two:
“0”: Device is an endpoint
“1”: Device is the coordinator
Default is endpoint. If the command is sent without an argument then the current value is
returned.
4.3.1.17 SM –Sleep mode
Sets the sleep mode for the device. This command is applicable for endpoints only and is not
applicable to coordinator devices. The parameter value can be one of the following:
“0”: Endpoint is always on
“1”: Endpoint sleeps
Default is always on. See the section on Sleep Modes for more detail about sleepy endpoints.
4.3.1.18 LW –Listen Window
When sleep mode is enabled on an endpoint, it wakes up under two conditions to send data
back to the coordinator (see the section on Sleep Modes). After data has been received by
the coordinator, it has a short window of time to send the endpoint a new packet before the
endpoint re-enters sleep mode. The parameter for the Listen Window is four ASCII coded hex
characters with units of milliseconds.
Default: 0019 for 25ms

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 15 OF 35
Range: 0000 to FFFF
4.3.1.19 QP - Queue Packet
This command is similar to the Send Packet (SP) command except it queues the packet to be
sent to a sleepy endpoint during the Listen Window. When the sleepy endpoint sends a
supervisory message to a coordinator, the coordinator responds with the queued packet
immediately and sends a status message back to the host indicating the queued message has
been sent.
This command is only valid for coordinator devices. If the destination endpoint is not sleepy,
this command will immediately send the packet similar to an SP command. See the section
on Sleep modes for more information.
4.3.1.20 ST –Supervisor Timeout
The supervisory function requires each endpoint to send a message back to the coordinator
on a periodic basis to indicate it is still alive and functional. When an endpoint is in sleep
mode, it will wake up temporarily to send the supervisory message and then re-enter sleep
mode automatically. This period should be as infrequent as possible and typically on the order
of one hour.
When the device is configured as an endpoint, this setting indicates the period at which it
sends the supervisor message to the coordinator. When the device is configured as a
coordinator, this is the window in which it expects to hear from each endpoint. If the
supervisor does not hear from an endpoint within this window it will send an error message
to the host. See the Supervisor section for more detail.
The parameter for the Supervisor Timeout is four ASCII coded hex characters with units of
minutes.
Default: 003C for 1 hour
Range: 0001 to FFFF
4.3.1.21 EE –Encryption enable
Enables encryption on the RF packets. The parameter value can be one of the following:
Note that larger values for the listen window gives the coordinator more
time to respond but at the expense of power consumption at the endpoint

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 16 OF 35
“0”: Encryption off
“1”: Encryption on
Default is encryption off. Note that the Session Key must be set prior to turning encryption on
with this command. If an endpoint receives the session key that was broadcast by the
coordinator, encryption will be automatically enabled. See the section on Security and
Encryption for more detail.
If this command is sent without an argument, the current value will be returned.
4.3.1.22 PK –Provisioning Key
Sets the encryption key that is used to encrypt keys that are broadcast wirelessly in the field.
This key can only be set through AT commands and should be set prior to deployment in the
field. The parameter for this command is the 128-bit / 16-byte AES encryption key in ASCII
coded hex values.
For example, if the 128-bit key is 0x12345678901234567890123456789012, then the
parameter would be the ASCII string “12345678901234567890123456789012”.
4.3.1.23 SK –Session Key
Sets the encryption key that is used to encrypt the payload for normal operation. This key can
be set either through AT commands or in the field by use of the Broadcast Key command. If
the session key is broadcast in the field, it is encrypted with the provisioning key set at the
factory. The parameter for this command is the 128-bit / 16-byte AES encryption key in ASCII
coded hex values.
For example, if the 128-bit key is 0x12345678901234567890123456789012, then the
parameter would be the ASCII string “12345678901234567890123456789012”.
Note the provisioning key cannot be read back. The value must be non-zero
before the Broadcast Key command is set to enable. See the section on
Security and Encryption for more detail.
Note the session key cannot be read back. The value must be non-zero
before the Encryption Enable command is set to enable. See the section on
Security and Encryption for more detail.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 17 OF 35
4.3.1.24 KU –Send Upper Half of Session Key
Send the upper half of the session key encrypted by the provisioning key. Note that both the
session key and provisioning key must be set prior to this command. This command is only
valid for coordinator devices and the parameter with this command is the 32-bit ASCII coded
Device ID of the target endpoint. This command is used along with KL (lower half of session
key) and encryption is automatically enabled on the endpoint when both halves of the key
arrive.
4.3.1.25 KL –Send Lower Half of Session Key
Send the lower half of the session key encrypted by the provisioning key. Note that both the
session key and provisioning key must be set prior to this command. This command is only
valid for coordinator devices and the parameter with this command is the 32-bit ASCII coded
Device ID of the target endpoint. This command is used along with KU (upper half of session
key) and encryption is automatically enabled on the endpoint when both halves of the key
arrive.
4.3.1.26 SV –SubGig stack version
This command will return two ASCII coded hex bytes representing the SubGig stack version
where the first two digits represent the major version and the last two digits represent the
minor version. For example, version 1.2 would be represented by the ASCII string “0102”. This
value is set at the factory and is read-only.
4.3.1.27 VR –Firmware version
This command will return four ASCII coded characters representing the module firmware
version where the first two digits represent the major version and the last two digits represent
the minor version. For example, version 1.2 would be represented by the ASCII string “0102”.
This value is set at the factory and is read-only.
4.3.1.28 HR –Hardware version
This command will return two ASCII coded hex bytes representing the SubGig stack version
where the first two digits represent the major version and the last two digits represent the
minor version. For example, version 1.2 would be represented by the ASCII string “0102”. This
value is set at the factory and is read-only.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 18 OF 35
4.3.1.29 DB –RSSI of last packet
This command returns the RSSI value of the last packet it received. The return value is a two
digit ASCII-coded hex value.
4.3.1.30 EA –Number of ack failures
This command returns the number of ack failures since the device was last reset. The return
value is in the form of a four digit ASCII-coded hex value. This value does include
retransmission events for the same packet. For example, if a device attempts a transmission
and never receives an ack, the device will attempt a total of 8 times before it stops. The
corresponding number of ack failures would then increment by 8.
4.3.1.31 OS –Number of out of sequence packets
This command returns the number of out of sequence packets that have been received since
last reset. The return value is in the form of a four digit ASCII-coded hex value.
4.3.1.32 RD –Device type
This command returns the device type of the module. The return value for the RBM101 is the
ASCII string “RBM101”
4.3.1.33 PL –Power Level
Set the radio transmit power level. The parameter is a 32-bit ASCII coded hex value and is in
units of deci dBm.
Default: 00000064 (10.0 dBm)
Note that not all values are achievable in the radio but the power will be set as close as
possible. After writing this parameter, use the PL command with no arguments to read back
the new power level from the radio.
Note the RBM101 is based on a Silicon Labs Flex Gecko radio. This device
uses an automatic gain control on the radio that can make the RSSI reading
non-linear and inconsistent as gain is added to the rx circuit. Use at your
own discression.

RADIO BRIDGE RBM101 USER GUIDE
COPYRIGHT ©2017, RADIO BRIDGE INC.RADIO BRIDGE RBM101 USER GUIDE PAGE 19 OF 35
4.3.1.34 RP –Reduce Power Level
Set the radio transmit power to a reduced level based on governor requirements. The
parameter value can be one of the following:
“0”: Reduced power mode off
“1”: Reduced power mode on
Default is off. When the command is used to turn the reduced power mode on, the transmit
power level is reduced to the level acceptable for periodic signals according to FCC
requirements. See the section on Governor for more detail.
4.3.1.35 TC –Test carrier
This command will cause the module to enter a debug mode where it transmits a constant
carrier signal at the center frequency of the module. The parameter value can be one of the
following:
“0”: Test carrier disabled
“1”: Test carrier enabled
Test carrier is disabled by default.
4.3.1.36 TP –Test packets
This command will cause the module to enter a debug mode where it transmits constant
packets over RF. The parameter value can be one of the following:
“0”: Test packets disabled
“1”: Test packets enabled
Test packets is disabled by default.
4.3.1.37 SN –Sniffer Mode
This command will cause the module to enter a debug mode where it “sniffs” all packets in
the air utilizing the SubGig protocol and display them with the “SNF” prefix. This “sniffing”
continues until the mode is disabled. The parameter value can be one of the following:
“0”: Sniffer disabled
“1”: Sniffer enabled
The sniffer is disabled by default. See the Sniffer Mode section for more detail.