Vimar 03925 User guide

03925
4-button flat device with 2.4 GHz Bluetooth® technology Low
Energy standard radiofrequency transmitter, energy harvesting sup-
ply powered by built-in electrodynamic generator, to complete with
Eikon 20506 or 20506.2, Arké 19506 or 19506.2 or Plana 14506 or
14506.2 buttons - 2 modules.
Installer Manual
HOME AUTOMATION

2

3
Index
1. General description …………………………………………………………………………………………………………………………………………………………………… 4
1.1 Basic functionality …………………………………………………………………………………………………………………………………………………………………… 4
1.2 Technical data ……………………………………………………………………………………………………………………………………………………………………… 4
1.3 Environmental conditions …………………………………………………………………………………………………………………………………………………………… 4
2. Functional information ………………………………………………………………………………………………………………………………………………………………… 5
2.1 03925 Device Overview …………………………………………………………………………………………………………………………………………………………… 5
2.2 Basic Functionality…………………………………………………………………………………………………………………………………………………………………… 5
2.3 User Interface………………………………………………………………………………………………………………………………………………………………………… 5
3. Telegram transmission ………………………………………………………………………………………………………………………………………………………………… 6
3.1 Radio channel parameters ………………………………………………………………………………………………………………………………………………………… 6
3.2 Default radio transmission sequence ……………………………………………………………………………………………………………………………………………… 6
3.3 User-defined radio transmission sequences ……………………………………………………………………………………………………………………………………… 6
4. Telegram format ………………………………………………………………………………………………………………………………………………………………………… 8
4.1 Preamble……………………………………………………………………………………………………………………………………………………………………………… 8
4.2 Access Address……………………………………………………………………………………………………………………………………………………………………… 8
4.3 Header ……………………………………………………………………………………………………………………………………………………………………………… 8
4.4 Source address ……………………………………………………………………………………………………………………………………………………………………… 8
4.5 Check Sum…………………………………………………………………………………………………………………………………………………………………………… 9
4.6 Payload …………………………………………………………………………………………………………………………………………………………………………… 10
4.7 Switch status encoding…………………………………………………………………………………………………………………………………………………………… 10
4.8 03925 telegram authentication …………………………………………………………………………………………………………………………………………………… 10
5. Commissioning ……………………………………………………………………………………………………………………………………………………………………… 12
5.1 NFC-based commissioning ……………………………………………………………………………………………………………………………………………………… 12
5.2 Camera-based commissioning ………………………………………………………………………………………………………………………………………………… 12
5.3 Radio-based commissioning …………………………………………………………………………………………………………………………………………………… 12
5.4 Factory Reset ……………………………………………………………………………………………………………………………………………………………………… 14
6. NFC interface ………………………………………………………………………………………………………………………………………………………………………… 15
6.1 Using the NFC interface ………………………………………………………………………………………………………………………………………………………… 15
6.2 NFC interface functions…………………………………………………………………………………………………………………………………………………………… 15
6.3 Configuration memory organization……………………………………………………………………………………………………………………………………………… 17
6.4 Memory Address Map …………………………………………………………………………………………………………………………………………………………… 18
6.5 Public data ………………………………………………………………………………………………………………………………………………………………………… 18
6.6 Protected Data …………………………………………………………………………………………………………………………………………………………………… 19
6.7 Private Data ……………………………………………………………………………………………………………………………………………………………………… 22
7. Application information……………………………………………………………………………………………………………………………………………………………… 23
7.1 Transmission range ……………………………………………………………………………………………………………………………………………………………… 23
7.2 Receiver configuration …………………………………………………………………………………………………………………………………………………………… 23
8. Installation rules ………………………………………………………………………………………………………………………………………………………………………… 24
9. Standard compliance ………………………………………………………………………………………………………………………………………………………………… 24

4
General description
1. General description
1.1 Basic functionality
03925 enables the realization of energy harvesting wireless switches for building or industrial automation systems communicating based on Bluetooth technology low
energy technology.
03925 pushbutton transmitters are self-powered (no batteries) and fully maintenancefree. They can therefore be used in all environments including locations that are
difficult to reach or within hermetically sealed housings. The required energy is generated by an electro-dynamic energy transducer actuated by an energy bow located
on the left and right of the module. This energy bow which can be pushed from outside the module by an appropriate pushbutton or switch rocker.
When the energy bow is pushed down or released, electrical energy is created and a radio telegram according to the Bluetooth technology low energy standard is
transmitted. This radio telegram transmits the status of all four contact nipples at the moment when the energy bow was pushed down or released.
03925 radio telegrams are protected with AES-128 security based on a device-unique private key.
Fig. 1: 03925
1.2 Technical data
Antenna Integrated PCB antenna
Max. transmit power measured 0.4dBm / 1.1mW
Communication Range (Guidance Only) 75 m ideal line of sight / 10 m indoor environment
Communication Standard Bluetooth technology Low Energy (BLE)
Radio Frequency (min / max) 2402 MHz / 2480 MHz
Default Radio Channels CH 37 / 38 / 39 (2402 MHz / 2426 MHz / 2480 MHz
)
Advertising Events per press or release (min / max) 2 / 3
Data Rate and Modulation 1 Mbit/s GFSK
Configuration Interface NFC Forum Type 2 Tag (ISO/IEC 14443 Part 2 and 3)
Device Identification Unique 48 Bit Device ID (factory programmed)
Security AES128 (CBC Mode) with Sequence Code
Power Supply Integrated Kinetic Energy Harvester
Button Inputs Up to four buttons or two rockers
1.3 Environmental conditions
Operating Temperature -25°C ... 65°C
Storage Temperature -25°C ... 65°C
Humidity 0% to 95% r.h. (non-condensing)

5
Functional information
2. Functional information
2.1 03925 Device Overview
The pushbutton transmitter module 03925 enables the implementation of wireless remote controls without batteries. It transmits Bluetooth technology Low Energy
(BLE) data telegrams where the required energy is provided by a built-in electro-dynamic energy generator.
The outer appearance of 03925 is shown in Figure 2 below.
2.2 Basic Functionality
03925 devices contain an electro-dynamic energy converter which is actuated by an energy bow (1). This bow is pushed by an appropriate push button, switch rocker
or a similar construction mounted onto the device. An internal spring will release the energy bow as soon as it is not pushed down anymore.
When the energy bow is pushed down, electrical energy is created and a BLE radio telegram is transmitted which identifies the action (pressed or not pressed) and the
status of the four button contacts (2). Releasing the energy bow similarly generates energy which is used to transmit a different radio telegram.
It is therefore possible to distinguish between radio telegrams sent when the energy bar was pushed and radio telegrams sent when the energy bar was released.
By identifying these different telegrams types and measuring the time between pushing and releasing of the energy bar, it is possible to distinguish between “Long” and
“Short” button contact presses. This enables simple implementation of applications such as dimming control or blinds control including slat action.
2.3 User Interface
03925 devices provide four button contacts. They are grouped into two channels (Channel A and Channel B) each containing two button contacts (State O and State I).
The state of all four button contacts (pressed or not pressed) is transmitted together with a unique device identification (48 Bit device ID) whenever the energy bow is
pushed or released.
Figure 3 below shows the arrangement of the four button contacts and their designation:
Fig. 2: Electro-dynamic powered pushbutton transmitter module 03925
State
Channel
Fig. 3: Button contact designation
(1) Energy bow on both device sides
(2) Button contacts for switch
rocker identication
Snap-in and rotation axis for pushbuttons or switch rocker

6
Telegram transmission
3. Telegram transmission
3.1 Radio channel parameters
03925 transmits Bluetooth technology Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz … 2480MHz).
By default, 03925 will use the three BLE advertising channels (BLE Channel 37, 38 and 39) defined for transmission. The transmission of a radio telegram on these
three advertising channels is called an Advertising Event.
Use of different radio channels within the frequency band from 2402 MHz to 2480 MHz is possible, see chapter 6.7.9.
The initialization value for data whitening is set as follows:
■For BLE channels is set according to specification (value = radio channel)
■For the custom radio channels the initialization value is equal to the offset from 2400 MHz (e.g. value = 3 for 2403 MHz)
Table 1 below summarizes radio channels supported by 03925.
Radio Channel Frequency Channel Type
BLE Radio Channel
37 2402 MHz BLE Advertising Channel
0 2404 MHz BLE Data Channel
1 2406 MHz BLE Data Channel
…
10 2424 MHz BLE Data Channel
38 2426 MHz BLE Advertising Channel
11 2428 MHz BLE Data Channel
12 2430 MHz BLE Data Channel
…
36 2478 MHz BLE Data Channel
39 2480 MHz BLE Advertising Channel
Custom Radio Channels
40 2403 MHz Custom Radio Channel
41 2405 MHz Custom Radio Channel
…
77 2477 MHz Custom Radio Channel
78 2479 MHz Custom Radio Channel
3.2 Default radio transmission sequence
03925 transmits telegrams in its standard configuration by using so-called Advertising Events.
An advertising event is defined as the transmission of the same radio telegram on all selected radio channels (by default this would be on BLE Channel 37, 38 and
39) one after another with minimum delay in between.
For reliability reasons, 03925 will send several (minimum two, maximum three) advertising events for each button input. The resulting transmission sequence is shown
in Figure 4 below.
CH37 CH38 CH39 Pause
(20 ms) CH37 CH38 CH39 Pause (20 ms) CH37 CH38 CH39
3.3 User-defined radio transmission sequences
In certain situations it might be desirable to transmit radio telegrams on channels other than the three advertising channels.
03925 therefore allows to select the radio channels to be used for the transmission of data telegrams and commissioning telegrams. The following transmission
modes are supported:
■Both commissioning telegrams and data telegrams are transmitted on the advertising channels as three advertising events. This is the default configuration and
described in chapter 3.2 above.
■Commissioning telegrams are transmitted on the advertising channels as three advertising events while data telegrams are transmitted in a user-defined sequence
as described below.
■Both commissioning and data telegrams are transmitted in a user-defined sequence as described below.
Table 1 – 03925 supported radio channels
Figure 4 – Default radio transmission sequence

7
Telegram transmission
The selection of the transmission mode is done using the CUSTOM_VARIANT register of the NFC configuration interface as described in chapter 6.7.8.
03925 supports the following user-defined sequences:
■Three channels sequence
This sequence is similar to the default Advertising Event with the difference that the user can select the radio channels to be used. The three channels sequence
is described in chapter 3.3.1 below.
■Two channels sequence
In this sequence the radio telegram is transmitted using four transmissions on two radio channels. It is described in chapter 3.3.2 below.
■One channel sequence
In this sequence the radio telegram is transmitted using six transmissions on one radio channel. It is described in chapter 3.3.3 below.
3.3.1 Three channels sequence
The three channels radio transmission sequence is similar to the default transmission sequence.
The difference is that the radio channels (BLE Channel 37, 38 and 39 in the default transmission sequence) can be selected using the registers CH_REG1,
CH_REG2 and CH_REG3.
The 03925 telegram will in this mode be transmitted on the radio channel selected by CH_REG1 first, immediately followed by a transmission on the radio
channel selected by CH_REG2 and a transmission on the radio channel selected by CH_REG3.
This transmission sequence will be sent three times in total with pauses of 20 ms in between as shown in Figure 5 below.
CH_REG1 CH_REG2 CH_REG3 Pause
(20 ms) CH_REG1 CH_REG2 CH_REG3 Pause (20 ms) CH_REG1 CH_REG2 CH_REG3
The format of CH_REG1, CH_REG2 and CH_REG3 is described in chapter 6.7.9.
3.3.2 Two channels sequence
The two channels radio transmission sequence removes transmission on the third radio channel (selected by CH_REG3) and instead repeats the transmission
once more (four times in total).
The 03925 telegram will in this mode be transmitted on the radio channel selected by CH_REG1 first, immediately followed by a transmission on the radio
channel selected by CH_REG2.
This transmission sequence will be sent four times in total with pauses of 20 ms in between as shown in Figure 6 below.
CH_REG1 CH_REG2 Pause
(20 ms) CH_REG1 CH_REG2 Pause (20 ms) CH_REG1 CH_REG2 Pause (20 ms) CH_REG1 CH_REG2
The format of CH_REG1 and CH_REG2 is described in chapter 6.7.9.
3.3.3 Single channel sequence
The single channel radio transmission sequence removes transmission on the second and third radio channel (selected by CH_REG2 and CH_REG3 respec-
tively), i.e. all transmissions will be on the radio channel selected by CH_REG1.
The 03925 telegram will be sent six times on this radio channel with pauses of 20 ms in between as shown in Figure 7 below.
CH_REG1 Pause
(20 ms) CH_REG1 Pause (20 ms) CH_REG1 Pause (20 ms) CH_REG1 Pause (20 ms) CH_REG1 Pause (20 ms) CH_REG1
The format of CH_REG1 is described in chapter 6.7.9.
Figure 5 – Three channels radio transmission sequence
Figure 6 – Two channels radio transmission sequence
Figure 7 – Single channel radio transmission sequence

8
Telegram format
4. Telegram format
03925 transmits Bluetooth technology Low Energy (BLE) radio telegrams in the 2.4 GHz band. For detailed information about the Bluetooth technology Low Energy
standard, please refer to the applicable specifications.
Figure 8 below summarizes the BLE frame structure.
Preamble
0xAA
Access Address
0x8E89BED6
Header
(2 Byte)
Source Address
(6 Byte)
Payload
(0…31 Byte)
Check Sum
(3 Byte)
The content of these fields is described in more detail below.
4.1 Preamble
The BLE Preamble is 1 byte long and identifies the start of the BLE frame. The value of the BLE Preamble is always set to 0xAA.
4.2 Access Address
The 4 byte BLE Access Address identifies the radio telegram type. For advertising frames, the value of the Access Address is always set to 0x8E89BED6.
4.3 Header
The BLE Header identifies certain radio telegram parameters. Figure 9 below shows the structure of the BLE header.
Bit 15 (MSb) Bit 0 (LSb)
UNUSED
(2 Bit)
LENGTH
(6 Bit)
RX ADDR
(1 Bit)
TX ADDR
(1 Bit)
UNUSED
(2 Bit)
TYPE
(4 Bit)
00 Length of
Address + Payload 0: Not used 1: Random 00 0010: TX-only Advertising (ADV_NONCONN_IND)
4.4 Source address
The 6 byte BLE Source Address (MAC address) uniquely identifies each 03925 product.
03925 supports two source address modes:
■Static Source Address mode (default) In this mode, the source address is constant (but its lower 32 bit can be configured via NFC interface)
■Private Resolvable Address mode (NFC configurable) In this mode, the source address changes for each transmission
03925 uses by default Static Source Address mode.
Private Resolvable Address mode can be selected by setting the Private Source Address flag in the Configuration register (see chapter 6.7.7) to 0b0.
These two address modes are described in the following chapters.
4.4.1 Static source address mode
By default, 03925 uses static source addresses meaning that the source address is constant during normal operation. The static source address can be read
and configured (written) via NFC as described in chapter 6.
The structure of 03925 static addresses is as follows:
■ The upper 2 bytes of the source address are used to identify the device type and set to 0xE215 for all 03925 devices. These two bytes cannot be changed.
■The lower 4 bytes are uniquely assigned to each device. They can be changed using the NFC configuration interface as described in chapter 6.7.3
Figure 10 below illustrates the static address structure used by 03925.
Product Type ID (16 Bit) Unique Device Address (32 Bit)
0xE215
MSB LSB
Figure 8 – Default radio transmission sequence
Figure 9 – BLE header structure
Figure 10 – BLE static source address structure

9
Telegram format
4.4.2 Private resolvable source address mode
For some applications it is desirable to modify (rotate) the source address used by 03925 in order to prevent tracking of its radio transmissions. At the same
time, each 03925 device must remain uniquely identifiable by the receiver.
To achieve these goals, 03925 can be configured via NFC to use random resolvable private addresses.
Using random resolvable private addresses requires that both 03925 and the receiver both know a common key – the so-called Identity Resolution Key (IRK).
03925 uses its device-unique random key as identity resolution key. This key can be configured via the NFC configuration interface as described in chapter 6.
For resolvable private addresses, the 48 bit address field is split into two sub-fields:
■ prand
This field contains a random number which always starts (two most significant bits) with 0b10. The prand value is changed for each telegram that is transmit-
ted. Individual advertising events used to transmit one telegram (as described in chapter 3) use the same prand value.
■hash
This field contains a verification value (hash) generated from prand using the IRK.
The structure of a random resolvable private address is shown in Figure 11 below.
prand (24 Bit) hash (24 Bit)
0 1 Random Data (22 Bit)
MSB LSB
The prand value is encrypted using the IRK. The lowest 24 bit of the result (encrypted value) are then used as hash.
The concatenation of 24 bit prand and 24 bit hash will be transmitted as 48 bit private resolvable source address.
The receiving device maintains a list of IRK for all transmitters that have been commissioned to work with it.
Whenever the receiving device receives a radio telegram with private resolvable source address (identified by the most significant bits being set to 0b10), it will
itself generate a 24 bit hash from the 24 bit prand sequentially using the IRK of each device that it has been learned into it.
If an IRK matches (i.e. when prand is encoded with this specific IRK then the result matches hash), then the receiver has established the identity of the trans-
mitter.
So conceptually the IRK takes the role of the device source address while prand and hash provide a mechanism to select the correct IRK among a set of IRK.
This mechanism is illustrated in Figure 12 below.
Transmitter Receiver
prand (24 Bit) hash (24 Bit) prand (24 Bit) hash (24 Bit)
=? Matching IRK
(Device Identity)
IRK (128 Bit)
IRK Device #1
IRK Device #2
IRK Device #3
…
IRK Device #n
4.5 Check Sum
The 3 byte BLE Check Sum is used to verify data integrity of received BLE radio telegrams.
It is calculated as CRC (cyclic redundancy check) of the BLE Header, Source Address and Payload fields.
Figure 11 – BLE private resolvable source address structure
Figure 12 – Resolving private source addresses

10
4.6 Payload
The payload of data telegrams is 13 … 17 bytes long (depending on the size of the Optional Data field) and consists of the following fields:
■Length (1 byte)
The Length field specifies the combined length of the following fields. The content of the field depends on the size of the Optional Data field (which can be 0 / 1 / 2
or 4 byte). The resulting Length setting would be 12 / 13 / 14 or 16 byte (0x0C / 0x0D / 0x0E / 0x10) respectively.
■Type (1 byte)
The Type field identifies the data type used for this telegram. For 03925 data telegrams, this field is always set to 0xFF to designate manufacturer-specific data field.
■Manufacturer ID (2 byte)
The Manufacturer ID field is used to identify the manufacturer of BLE devices based on assigned numbers. Vimar has been assigned 0x03DA as manufacturer ID
code. The Manufacturer ID can be changed via the NFC configuration interface as described in chapter 6.7.5.
■Sequence Counter (4 byte)
The Sequence Counter is a continuously incrementing counter used for security processing. It is initialized to 0 at the time of production and incremented for each
telegram (data telegram or commissioning telegram) sent.
■Switch Status (1 byte)
The Switch Status field reports the button action. The encoding of this field is described in chapter 4.7.
■Optional Data (0 / 1 / 2 or 4 byte)
03925 provides the option to transmit additional user-defined data within each data telegram. This data can be used to identify user-specific properties. The length
of the Optional Data field is defined in the Configuration register as described in chapter 6.7.7.
■Security Signature (4 byte)
The Security Signature is used to authenticate 03925 radio telegrams as described in chapter 4.8.
Figure 13 below illustrates the data telegram payload.
0x0C
…
0x10
0xFF Manufacturer ID
0x03DA
Sequence Counter
(4 Byte)
Switch
Status
Optional Data
(0/1/2/4 Byte)
Security Signature
(4 Byte)
LEN TYPE
4.7 Switch status encoding
The Switch Status field within the Payload data identifies the 03925 action (button push or release). 03925 uses the following sequence to identify and transmit but-
ton contact status:
1. Determine direction of the energy bar movement (Push Action or Release Action)
2. Read input status of all button contacts
3. Calculate data payload
4. Calculate security signature
In 03925, the type of action (Press Action or Release Action) is indicated by Bit 0 (Energy Bar). If a button contact has been actuated during Press Action or Release
Action then this is indicated by the according status bit set to ‘1’.
Note that all contacts that were pressed during Press Action will be released during Release Action. The case of continuing to hold one (or several) button contacts
during Release Action is mechanically not possible.
The switch status encoding used by 03925 is shown Figure 14 in below.
Switch Status
Reserved B1 B0 A1 A0 ACTION
TYPE
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Shal be 0b000 0 = No Action
1 = Action
0 = No Action
1 = Action
0 = No Action
1 = Action
0 = No Action
1 = Action
0 = Release Action
1 = Press Action
4.8 03925 telegram authentication
03925 implements telegram authentication to ensure that only telegrams from senders using a previously exchanged security key will be accepted. Authentication
relies on a 32 bit telegram signature which is calculated as shown in Figure 15 below and exchanged as part of the radio telegram.
Telegram format
Figure 13 – Data telegram payload structure
Figure 14 – 03925 button action encoding