跳转到内容
YBO 技术文档

20260929-0031-air-433-encrypted-variant Add an Air 433 variant on TI CC1310 with the hub's encrypted 433 MHz link

  • status: completed
  • createdAt: 2026-09-29 00:31
  • approvedAt: 2026-09-29 (owner: "然后开始做文档" after both proposals; recommended options taken)
  • relatedTask: 20260929-0031-air-433-encrypted-variant

Context

章节标题：“Context”
  • Air spec R0.6: BLE-only single hardware platform on nRF54L15 and 1×CR2450; sub-GHz is open item AIR-O-09 (overlay vs conditional replacement); design §2.3 lists CC1312R, CC1354R10, SX1262, LR1121, STM32WLE5, EFR32FG28 and says any sub-GHz link needs its own security design.
  • Hub plan 20260929-0011 (implementing, other session): both Air Hub products carry a CMT2300A 433 MHz link; the YBO device class uses a per-device key set in a ≤60 s authorization window, AES-128-CCM on every frame, a monotonic counter with replay rejection and acknowledged commands with read-back; third-party OOK is a separate lower-trust class; the receive scheme (YBO frames on the OOK configuration or time-sliced OOK / FSK) is still open; EU EN 300 220 433.05–434.79 MHz ≤10 mW ERP, US 47 CFR 15.231. It left "Air's 433 version" as a separate follow-up.
  • CMT2300A (HopeRF datasheet Rev 1.8, 3.3 V, 433.92 MHz): TX 23 mA @ +13 dBm, 72 mA @ +20 dBm; RX 8.5 mA (high-performance) / 7.2 mA (low-power); sleep 300 nA; sensitivity −121 dBm @ 2 kbps, −111 dBm @ 50 kbps; OOK and (G)FSK; LCSC $0.87 @1k.
  • Coin-cell limit in design §2.2: RF peak ≤11 mA; CR2450 end-of-life ~100 Ω. 23 mA would drop ~2.3 V from the cell alone, so TX power, frame length and storage capacitance decide feasibility. A 5 s continuous RX wait for read-back (AIR-04) at 7.2 mA is 36 mC per press — about 110 mAh/year at 30 presses a day against a 400 mAh total budget.

Proposal

章节标题：“Proposal”

Revised 2026-09-29 after owner decisions (see Annotations): the 433 variant is a separate board on TI CC1310 alone; the BLE Air stays nRF54L15 alone with no CMT2300A.

CC1310 (TI SWRS181, LCSC 2026-09-29): Sub-1 GHz SoC, Cortex-M3, 128 KB flash / 20 KB RAM, AES-128 and TRNG in hardware, 1.8–3.8 V, RX 5.4 mA, TX 13.4 mA @ +10 dBm, standby 0.7 µA; CC1310F128RHBR VQFN32 5×5 $1.92 @1k (C69860). No BLE, no NFC, no secure boot listed.

Spec P05-air.md:

  1. §1 / §2: two models per key count on separate boards: Air 2 / Air 4 (nRF54L15, BLE) and Air 2 / Air 4 433 (CC1310, 433.92 MHz). Both share the 86-type enclosure, keys, LEDs and CR2450; Air 433 never emits plaintext third-party codes.
  2. §3: new AIR-11 (433 link, YBO class of the hub's link): per-device key established by ECDH over 433 inside a ≤60 s authorization window, authenticated by a per-device pairing code printed inside the battery compartment and entered through Mate / Studio to the hub; the code is not the key and is useless without the window. AES-128-CCM on every frame; send and receive counters persisted across battery swap and reset (reserved blocks, skip ahead on boot); the hub rejects any frame that is not newer, so a recorded frame is never accepted; hub results also counter-protected; ACK and read-back per SYS-02 / AIR-10. SEC-01…04 apply unchanged.
  3. §6: onboarding rule gets a 433 branch (the pairing-code method above); firmware update for the 433 model runs over 433 via an authorized hub with signed images (SEC-05), within the regional duty-cycle limit.
  4. §2 battery row: 433 model keeps CR2450; its life target is set after the budget in design §4 is redone.
  5. §7: 433 compliance (EN 300 220 / RED; China SRRC micro-power 433; US per decision L).
  6. §8: AIR-O-09 closed as "separate 433.92 MHz model on CC1310"; LoRa not used on Air; new open item for link parameters shared with the hub (modulation, data rate, sync word, whitening, CRC, frame format) with a CC1310 ↔ CMT2300A interoperability test; AIR-O-02 adds the 433 pairing-code demonstration.
  7. Change-log row.

Design appendix: §2.3 rewritten around CC1310 (earlier candidates, CMT2300A + HC32L130 and CC1312R kept as compared with figures); §3 second block diagram for the 433 board; §4 433 power budget and the receive-window rule; §5 433 antenna in the 86 plate (PCB loop or helical, efficiency measured); §6 key, counter, frame and update handling; change-log row.

Guide: V-03 recorded-frame replay, counter rollback and pairing-code misuse on 433; V-04 433 budget; V-05 433 link loss; V-09 433 update; D0 demo of CC1310 ↔ CMT2300A interoperability; quotation per model.

Brief, product plan wireless row, Air index, changelog; task and plan status.

Remaining decisions (recommended default first):

  • J. RF parameters: (J1) 2-GFSK at tens of kbps, TX ≤ +10 dBm, matching the hub's receive scheme; (J2) OOK.
  • K. Result wait: (K1) short ACK window after each transmission, read-back in scheduled short windows, no 5 s continuous RX; life target after measurement; (K2) 5 s continuous RX.
  • L. Regions: (L1) 433.92 MHz China / Europe only; North America follows hub AIR-O-13; (L2) add 915 MHz now.

Risks

章节标题：“Risks”
  • Coin-cell feasibility is the main risk: 433 TX and RX currents are 2–4× the nRF54L15 BLE figures; the 433 SKU may not reach the three-year target.
  • CC1310 and the hub's CMT2300A must agree on PHY and packet format; interoperability is unproven until tested.
  • CC1310 lists no secure boot; signed-image checking is done by the bootloader and debug lock must be confirmed for SEC-05.
  • A 433 antenna inside an 86 plate is electrically small; range must be measured against BLE.
  • The hub-side receive scheme and frame format are not fixed yet; Air cannot freeze its link before the hub does.

Scope

章节标题：“Scope”

About 7 documentation files: Air spec, design appendix, guide, brief, index, product plan, changelog, task/plan indexes. No code. Touches the same Air files as 20260929-0027-air-86-enclosure-and-peripherals; implement after it.

Alternatives

章节标题：“Alternatives”
  • nRF54L15 + CMT2300A on one board: rejected by the owner (nRF54L15 is the 2.4 GHz model).
  • CMT2300A + HC32L130 (~$1.5): same radio as the hub, but higher RF current than CC1310.
  • CC1312R ($2.43): more flash, higher cost and TX current at +14 dBm.
  • Rolling code (KeeLoq-style) instead of AES-CCM: rejected, weaker and not what the hub link specifies.

Annotations

章节标题：“Annotations”
  • 2026-09-29: owner asked for a cheaper, lower-power choice than nRF54L15 for the 433 model and chose CC1310 ("用A"); nRF54L15 is the 2.4 GHz model and gets no CMT2300A ("nRF54L15是2.4g的不需要加CMT2300A"). Pairing by ECDH over 433 plus a battery-compartment code is the working assumption, not yet confirmed by the owner.
  • 2026-09-29: implemented with J1 (modulation follows the hub: its design appendix recommends YBO frames on the shared OOK receive configuration, so the Air 433 uses OOK unless the hub moves to OOK / FSK time-slicing, then 2-GFSK; TX ≤ +10 dBm), K1 and L1. Spec R0.8 (AIR-11, AIR-O-14, AIR-O-09 closed), design appendix R0.6, guide R0.4, brief, index, product plan. Hub files and the wireless SoC catalogue were not touched (owned by task 20260929-0011). Gate passed.