SYSTEM SENSOR WIRELESS REPEATER PRODUCT SPECIFICATION

Model name: M200F-RF Introduction: The 200 Series Commercial RF System is designed for use with compatible intelligent fire systems using the System Sensor 200/500 Series CLIP, Enhanced and Advanced communication protocols. It translates device coding from the radio domain to communication loop addresses recognised by the Control and Indicating Equipment (CIE). Each radio component contains a microcontroller and a transceiver with bi-directional RF data communications. There are two integrated antennae on the PCB for spatial diversity and for a uniform irradiation field. The radio devices are organized in a mesh network topology: this with the other above mentioned characteristics assures a connection in which the data security approaches that of hard-wired apparatus. Description: the M200F-RF repeater module is a battery operated device that doesn t perform any operation related to the fire detection system, but being part of the mesh network it allows increasing the distance between two fire devices belonging to the same gateway net. It simply receives messages from children and transmits to fathers and vice versa. The only quantity measured by the module is the remaining battery life. The M200F-RF communicates with the Radio Gateway module that directly interfaces the control panel and translates the radio messages in loop messages. The M200F-RF appears to the CIE as an output (control) module (CLIP protocol); it takes one module address on the loop, set on two rotary switches. The behaviour of a 200 Series Advanced (CLIP compatible version) wired module is simulated by the gateway. A tamper detection system is implemented to detect the removal of the module from its base. The radio circuit operates in the 865-870 MHz band using 18 different channels, with respect to E.T.S.I. EN 300-220-1 specifications and conforming to EN54-25. Depending on the parameters stored and to the network condition, the module can be in one of the following states: Uncommissioned: network parameters not downloaded; waiting to be programmed. Synch: network parameters downloaded, trying to synchronize with the network and join it. Idle: this status is entered when the gateway is disconnected from the loop for maintenance or for troubles. The RF device will stay in synch with the neighbors. Normal: normal communication within the established network Internal Fault: wireless/internal circuit initialization troubles. 1 of 20 LIFE

Years SYSTEM SENSOR WIRELESS REPEATER PRODUCT SPECIFICATION Power supply and LED: 4 x 3V, CR123A lithium batteries are used to power the device. The approved battery type for the module is Duracell Ultra 123 Lithium/Manganese dioxide and Panasonic Industrial 123. For battery life see the following graphs: other than the temperature, the power consumption depends on the number of parents and children assigned to the node. All these data refer to the specified batteries. 9 8 7 6 5 4 3 2p, 0c 2p,2c 2p, 4c 2 1 0-30 -20-10 0 10 20 30 40 50 60 Temperature C Fig.1 - Battery life (4.9s super frame) 2 of 20 LIFE

The device has a three color (red/green/amber) LED. When the network is operating (Normal mode) the LED can be controlled by the CIE using the loop protocol features. When the network is down, the LED behavior depends on the state of the device. In some cases there are specified different combinations of colours, where the temporal blinking sequence is: LED pulse colour 1 pause of 0.7 s LED pulse colour 2 pause of 14s repeat. At power up the LED blinks in the following way: Initialization failure: amber blink. Initialization ok, Device Uncommissioned: long green pulse. Initialization ok, Device Commissioned: 3 short green pulses. Then: Module in Internal Fault status: the LED will blink amber. Module in Synch status: the LED will blink green and then amber every 14 seconds or green on every communication received. Module in Uncommissioned status: the LED will blink red and then green every 14 seconds or green on every communication received. Module in Idle status: the LED will blink amber and then green every 14 seconds. Module in Normal status: the LED can be controlled by the panel using the loop protocol features. Three different patterns are available: o Red steady ON o Steady OFF o Green normal periodical pulse (equivalent to the wired module blink on communication) 3 of 20 LIFE

Loop LED control and PW change (500 series mode) Control Bit LED PW3 latch reset PW5 enabled Remote Test* 000 Red ON Y Y ON 001 Red ON Y Y No change 010 Red ON Y N ON 011 Red ON Y N No change 100 OFF N Y No change 101 Green Blink N Y OFF 110 OFF N N No change 111 Green Blink N N OFF * Control bit code must be received twice in succession in order to be executed. 4 of 20 LIFE

Fault Amber blink Transceiver check fail Internal Error Power Up Network parameters not downloaded 1 long green blink Network parameters downloaded 3 fast green blink Synch Green/Amber blink Network parameters downloaded Uncomm Red/Green blink Synchronization lost Synchronization ok with Node 1 Synchronization ok with GW Idle Amber/Green GW re join network Normal Controlled by panel Fig.2 - Device Status and Led Behavior 5 of 20 LIFE

ELECTRICAL SPECIFICATIONS ITEM TYP MIN MAX UNITS COMMENTS Operating Voltage 3 2.5 3.3 VDC 4 x 3V Duracell Ultra 123 Lithium/Manganese Dioxide batteries or Panasonic Industrial 123 Supply current in TX 65 -- -- ma @ 25mW (14dBm) of Output Power Supply Current in RX 18 -- -- ma @ 75.1 kbit/s Supply Current in Stand by 10 -- -- µa During no communication phases Supply Current Red LED on 4 -- -- ma Supply Current Green LED on 11 -- -- ma Supply Current Amber LED on 15 -- -- ma Normal periodical pulse: on time 40 -- -- ms Normal periodical pulse: off time 4.9 -- -- s Blink mode Normal periodical pulse: off time 1.4 -- -- s Intermittent mode 6 of 20 LIFE

Transceiver characteristics: The transceiver operates in the 865-870 MHz frequency band, using GFSK (Gaussian Frequency Shift Keying) modulation with respect to E.T.S.I. EN 300-220-1 specifications (Short Range Devices) and EN54-25: this allow having 18 channels available. The transmitter has an integrated PLL synthesizer which uses a crystal oscillator to guarantee the right carrier frequency. The integrated high efficiency power amplifier can transmit up to 14 dbm (25mW). System s transfer rate is set to 75.1 kbps. The receiver sensitivity is - 100 db with respect to E.T.S.I. EN 300-220-1 specifications TRANSCEIVER SPECIFICATIONS ITEM TYP MIN MAX UNITS COMMENTS Channel width -- -- 250 khz Modulation GFSK Data rate 75.1 -- -- kbit/s Output power (50) -- -- 14 dbm Vcc=3V E.I.R.P. (Effective Isotropic Radiated Power) -- -- 13.5 dbm Vcc=3V Antenna 2 Built on PCB Linear range 500 -- -- m In free air 7 of 20 LIFE

CHANNELS AND FRQUENCIES Channel Center frequency Bandwidth Band Max Power Max Duty Cycle Note (MHz) (khz) (mw) (%) 0 865.125 250 G1 25 0.1 * Reserved 1 865.375 250 G1 25 0.1 * 2 865.625 250 G1 25 0.1 * 3 865.875 250 G1 25 0.1 * 4 866.125 250 G1 25 0.1 * 5 866.375 250 G1 25 0.1 * 6 866.625 250 G1 25 0.1 * 7 866.875 250 G1 25 0.1 * 8 867.125 250 G1 25 0.1 * 9 867.375 250 G1 25 0.1 * 10 867.625 250 G1 25 0.1 * 11 867.875 250 G1 25 0.1 * 12 868.150 250 G1.1 25 0.1 13 868.450 250 G1.1 25 0.1 14 868.825 250 G1.2 25 0.1 15 869.075 250 G1.2 25 0.1 16 869.525 250 G1.3 25 0.1 17 869.850 250 G1.4 25 0.1 **At the time of writing this document, while the 868-870 range is widely accepted all over the Europe, there are still some exceptions for the 865-868 range. Following the situation of the countries where the ERC/REC 70-03 (22 May 2015 edition) is not implemented: Belarus: limited implementation (G1, G1.2,G1.3) Georgia: not implemented Greece: limited implementation (G1) Norway: Limited implementation (G1) Russian Federation: limited implementation (G1, G1.1,G1.3, G1.4) Spain: limited implementation (G1) Sweden: not implemented (G1) Ukraine: limited implementation 8 of 20 LIFE

RF Protocol: the RF communication is established using Cascading Wave Communication protocol, developed by Honeywell. It provides a deterministic redundant communication without congesting the network in high traffic scenarios. The basic network element is called node, and the network root element (node 0) is called gateway. Every node allows for multiple links, in order to connect the node to the other ones in both network boundaries direction (children nodes) and network root nodes (parent nodes). Each parent receives data from its children, and forwards such data packets along with its own information back to the gateway. Each child receives data from its fathers and forwards such data packets to its descendants. This way, every node can be considered also as a repeater. Each child can have up to two parents, to guarantee redundancy and alternative paths to complete the data transmission to and from the gateway. In this way even if a node fails, there is always another one being able to complete the communication chain. Each node, but the gateway, can have up to 4 children. The gateway can have a number of children equal to the maximum number of nodes present on the network. To avoid messages collision a TDMA approach is used (Time Division Multiple Access) and this is why each device has a Temperature Controlled Chrystal Oscillator (TCXO) which ensures a high quality timing reference. Node 4 (Child of Node 0) Node 6 (Child of Node 2) Node 7 (Child of Node 2) Gateway (Node 0) (Parent of Nodes 1,4,5) Node 1 (Child of Node 0) (Parent of Node 2) Node 2 (Child of Node 1) (Parent of Nodes 3,6,7) Node 3 (Child of Node 2 and Node 5) Node 5 (child of Node 0) (Parent of Node 3) Fig.3 - Example of Network and parent child relationship 9 of 20 LIFE

MECHANICAL SPECIFICATIONS SPECIFICATION TYP MIN MAX UNITS COMMENTS Height 52 mm When used with a B501RF base Diameter 102 mm Weight 115 g Batteries excluded Weight 181 g Batteries included ENVIRONMENTAL SPECIFICATIONS SPECIFICATION TYP MIN MAX UNITS COMMENTS Humidity 10 93 % RH Non condensing Temperature -30 60 C Maximum installation temperature range -30 60 C Maximum operating temperature range 10 of 20 LIFE

Loop Communication Protocol: the Radio Gateway module directly interfaces the CIE, translating the information received via RF from the module in a 200 Series Protocol (and its variants) frame. The RF module is seen from the CIE as a wired module of the 200 Series Advanced (CLIP compatible version) and has a type ID of an output (control) module, and takes one module address on the loop. For the different protocol variants, the waveform quantities and messages are specified below. REFERENCE TABLE DRAWING NO. S61-0491-xxx S61-432-000 S61-431-000 ADVANCED PROTOCOL SPECIFICATION 500 SERIES PROTOCOL DESIGN GUIDE ENHANCED PROTOCOL DESIGN GUIDE MODULE PW DEFINITIONS PW1 PW2 PW3 PW4 PW5 PW6* PW7* PW8* REFERENCE REMOTE COMMAND STATUS LATCHED SUPERVISION ANALOG SUPERVISION TYPE IDENTIFICATION Not used Not used BATTERY LEVEL PW9* LINK QUALITY * If extended PW feature enabled. 11 of 20 LIFE

PW LIMITS ABSOLUTE LIMITS in µs (due to environmental/aging effects MIN TYP MAX PW1 285 305 315 PW2 (Normal) 285 305 315 PW2 (Remote Test) 570 610 630 PW3 (Normal) 285 305 315 PW3 (Fault - Battery Not Fitted / Tamper Open / RF Link Trouble / Internal Fault / Battery Fault) 570 610 630 PW4 (Normal) 900 1008 1100 PW4 (Maintenance Alert Battery Warning, less than 6 months of battery life) 425 458 475 PW4 (Maintenance Urgent Battery Fault, less than 1 month of battery life) 285 305 315 PW4 (Fault - Battery Not Fitted / Tamper Open / RF Link Trouble / Internal Fault) 128 152 160 PW5 570 610 630 PW6* 0 0 0 PW7* 0 0 0 PW8* (Estimated remaining battery life) In months: PW8/61µs 61 -- 2930 PW9* (Link Quality) Bad (RSSI < -94dBm; Comm loss > 40%) 285 305 315 PW9* (Link Quality) Poor (RSSI > -94dBm; Comm loss < 40%) 570 610 630 PW9* (Link Quality) Medium (RSSI > -84dBm; Comm loss < 20%) 855 915 945 PW9* (Link Quality) Good (RSSI > -74dBm; Comm loss < 5%) 1140 1190 1260 * If extended PW feature enabled. 12 of 20 LIFE

Advanced protocol: While maintaining backward compatibility, the Advanced protocol provides new capabilities, including bi-directional digital communication, interrupt feature, group polling format for fast response to alarm conditions and improved power delivery. The Advanced protocol defines two modes of communication, designated Direct Poll and Group Poll: these two modes communicate either with one device at a time or simultaneously with a group of devices. This protocol contains a rapid alarm or fault detection feature which enables any device to signal the control panel when the device detects an alarm or fault condition. The alarm/fault condition represents a condition in the device which has been defined to require attention from the panel. This signal can be generated by any device where an alarm or fault condition occurs. This feature is factory set according to customer requirements, but it can be modified by special commands. Some parameters stored in EEPROM can be read or written to by means of Advanced protocol commands: refer to Parameter Table for a description of the read and/or write parameters. Four bytes in the EEPROM are used as a serial number, which can be read at panel start-up to detect double addresses. 13 of 20 LIFE

SUB-ADDRESS LOCATIONS VALUE MEANING DIRECTION COMMENTS 0 System Input 1 Analog supervision Input 116 Battery 1 level Input 117 Battery 2 level Input 118 Battery 3 level Input 119 Battery 4 level Input 120 Estimated remaining battery life Input 121 RSSI Parent 1 Input 122 RSSI Parent 2 Input 123 RSSI Child 1 Input 124 RSSI Child 2 Input 125 RSSI Child 3 Input 126 RSSI Child 4 Input 127 N.U. Input 129/139 LED control Output 14 of 20 LIFE

INPUT SUB-ADDRESS LIMITS SUB ADDRESS MEANING CONDITION ABSOLUTE LIMITS (due to environmental/aging effects) COMMENTS MIN TYP MAX 0 System Normal 62 Internal Fault 1 5 Battery Not Fitted 16 At least one battery not fitted Battery Fault 17 Less than 1 month of remaining battery life Tamper Open 18 RF Link Trouble 19 Battery Warning 38 Less than 6 months of remaining battery life Power Up special value 255 1 Analog supervision Normal 62 116 Battery 1 level Normal 230 255 117 Battery 2 level Normal 230 255 118 Battery 3 level Normal 230 255 119 Battery 4 level Normal 230 255 120 Estimated Remaining battery life Normal 6 255 Estimated remaining battery life in months 121 RSSI Parent 1 Bit 7, Bit 6 (LQ) 0 Comm Error Rate > 40% 1 Comm Error Rate < 40% 2 Comm Error Rate < 20% 3 Comm Error Rate < 5% Bit 5 Bit 0 (RSSI) RSSI = - (2*In121(RSSI))dBm 122 RSSI Parent 2 Bit 7, Bit 6 (LQ) 0 Comm Error Rate > 40% 1 Comm Error Rate < 40% 2 Comm Error Rate < 20% 3 Comm Error Rate < 5% Bit 5 Bit 0 (RSSI) RSSI = - (2*In122(RSSI))dBm 123 RSSI Child 1 Bit 7, Bit 6 (LQ) 0 Comm Error Rate > 40% 1 Comm Error Rate < 40% 2 Comm Error Rate < 20% 3 Comm Error Rate < 5% Bit 5 Bit 0 (RSSI) RSSI = - (2*In123(RSSI))dBm 124 RSSI Child 2 Bit 7, Bit 6 (LQ) 0 Comm Error Rate > 40% 15 of 20 LIFE

1 Comm Error Rate < 40% 2 Comm Error Rate < 20% 3 Comm Error Rate < 5% Bit 5 Bit 0 (RSSI) RSSI = - (2*In124(RSSI))dBm 125 RSSI Child 3 Bit 7, Bit 6 (LQ) 0 Comm Error Rate > 40% 1 Comm Error Rate < 40% 2 Comm Error Rate < 20% 3 Comm Error Rate < 5% Bit 5 Bit 0 (RSSI) RSSI = - (2*In125(RSSI))dBm 126 RSSI Child 4 Bit 7, Bit 6 (LQ) 0 Comm Error Rate > 40% 1 Comm Error Rate < 40% 2 Comm Error Rate < 20% 3 Comm Error Rate < 5% Bit 5 Bit 0 (RSSI) RSSI = - (2*In126(RSSI))Bm 127 N.U. -- 0 0 As a non isolated device 16 of 20 LIFE

PARAMETER TABLE (Latches/Interrupts applicable only to sub address 0, other sub addresses have no parameters) NR. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 SUB-ADDRESS 0 PARAMETER Implementation ID (*) Type ID (*) OEM ID (*) Firmware Revision (*) User Checksum (*) Configuration Status (*) Device Configuration Latch Enable Register Latch Mode Register Rising Interrupt Enable Register Falling Interrupt Enable Register Alarm Hysteresis Value Trouble Hysteresis Value Threshold 0 Threshold 1 Threshold 2 Threshold 3 Group code 1 Group code 2 Group code 3 Group code 4 User Byte 1 User Byte 2 * = read only ** same OEM ID of the associated gateway DFLT 1 222 ** Rev. Nr. Chksum 1 1 3 12 12 12 0 0 30 41 255 255 0 0 0 0 0 0 17 of 20 LIFE

DIRECT AND GROUP POLLING COMMANDS DIRECT/GROUP FUNCTION SUBADDRESS DATA/DIRECTION DATA DESCRIPTION COMMAND ID 0 Expansion For future command expansion 1 Set Output 129/139 2 bytes - panel to device (data byte repeated) Command follows in next data packet 0 LED Off 1 Red LED Blinking (default value) 2 Red LED On 3 Red LED Intermittent 4 Green LED Blinking 5 Green LED On 6 Green LED Intermittent 7 Amber LED Blinking 8 Amber LED On 9 Amber LED Intermittent 2 Unused Unused command 3 Write Parameter 0 2 bytes - panel to device Parameter Number: 0 Data: 0 255 Write specified parameter (See Parameter Table for details) 4 Read Address by NO 4 bytes - panel to device $00.00.00.00 $FF.FF.FF.FF Transmit Address of factory programmed Serial Number Serial Number 1 byte - device to panel 0 159 Decimal address returned 5 Disable Answer NO 4 bytes - panel to device $00.00.00.00 $FF.FF.FF.FF Disable any answer of factory programmed Serial Number by Serial Number 6 Read Address Message ignored 7 Force Device NO No data Force device update (factory use only) Update 8 Synchronize Message ignored 9 Reset Power On NO No data Clears power-on condition in devices 10 Initialize Device NO No data Re-read the whole non-volatile memory and initialize RAM variables 11 Unused Unused command 18 of 20 LIFE

DIRECT FUNCTION COMMAND 129 Read Output Status SYSTEM SENSOR WIRELESS REPEATER PRODUCT SPECIFICATION SUBADDRESS ID DATA/DIRECTION DATA LIMITS DESCRIPTION 129 1 byte - device to panel 0 LED Off 1 Red LED Blinking (default value) 2 Red LED On 3 Red LED Intermittent 4 Green LED Blinking 5 Green LED On 6 Green LED Intermittent 7 Amber LED Blinking 8 Amber LED On 9 Amber LED Intermittent 0 1 byte - device to panel 0 255 Read Condition Latch value 130 Read Condition Latch 131 Read Parameter 0 1 byte - panel to device Parameter Number: 0, 1, 127 Read specified device parameter 1 byte - device to panel Data: 0 255 (See Parameter Table) 132 Read Multiple 0 N bytes - device to panel 0 255 Read all parameters from specified sub-address Parameter (See Parameter Table) 133 Read Serial NO 4 bytes - device to panel $00.00.00.00 $FF.FF.FF.FF Transmit factory programmed Serial Number for device addressed Number by Address 134 Read Input value 0-1, 116-126 1 byte - device to panel 0 255 Transmit processed value or sensing element raw values. If there is an internal error e.g. memory checksum error, then sub-address 0 will be 1 135 Read Multiple Input Values NO N bytes - device to panel 0 255 Transmit all processed value and sensing element raw values. (See Parameter Table) 136 Read Multiple Condition Latches NO N bytes - device to panel 0 255 Transmit all sub-addresses Condition Latches (See Parameter Table) 19 of 20 LIFE

SPECIAL COMMANDS SUBADDRESS ID SYSTEM SENSOR WIRELESS REPEATER PRODUCT SPECIFICATION DATA/DIRECTION DATA LIMITS DESCRIPTION Read Alarm Latch Units NO 10 bits - device to panel 0 1023 Devices with an alarm condition that match the specified tens address sink current in bits 9-0 corresponding to their units address Read Alarm Latch Tens NO 10 bits - device to panel 10 bits - device to panel (only 16 used) 0 1023 0 1008 Devices with an alarm condition sink current in bits 15-0 corresponding to their tens address Read Trouble Latch Units NO 10 bits - device to panel 0 1023 Devices with an trouble or power-on condition that match the specified tens address sink current in bits 9-0 corresponding to their units address Read Trouble Latch Tens NO 10 bits - device to panel 10 bits - device to panel (only 16 used) 0 1023 0 1008 Devices with an interrupt sink current in bits 15-0 corresponding to their tens address Read Presence NO 10 bits - device to panel 0 1023 All installed devices that match the specified the tens address sink current in bits 9-0 corresponding to their units address. Null Message NO No data Message only allows for Interrupt Interval to be used Note: $ indicates hexadecimal value 20 of 20 LIFE