Z-Wave, ZWLR & Low-Power Automation Protocols
Standardized internationally as ITU-T G.9959, Z-Wave operates in dedicated sub-1GHz spectrum far below congested 2.4 GHz Wi-Fi. With Security 2 (S2) authenticated encryption and Z-Wave Long Range (ZWLR) star networking, it bridges home automation with mile-range commercial telemetry.
01 · ITU-T G.9959 Physical and MAC Architecture
Z-Wave defines three standardized data rates across its sub-1GHz channel allocations (908.4 MHz / 916.0 MHz in North America, 868.4 MHz in Europe):
- R1 (9.6 kbps): Legacy 2-FSK with Manchester encoding. Retained for backwards compatibility with early 100/200-series nodes.
- R2 (40 kbps): 2-FSK with NRZ encoding. Standard telemetry rate for 300/400-series nodes.
- R3 (100 kbps): GFSK () with NRZ encoding. Standard high-speed channel for modern 500, 700, and 800-series hardware. Z-Wave Long Range does not use it: ZWLR has its own 100 kbps DSSS-OQPSK PHY.
| Preamble | SOF (1–2B) | Home ID (4B) | Source (1–2B) | Frame Ctrl (1B) | Length (1B) | Dest (1–2B) | Payload (Var) | Checksum (1–2B) |
|---|---|---|---|---|---|---|---|---|
| 0101 Sync | 0xF055 | 32-bit Net ID | Transmitter | Routing Flags | Byte Count | Recipient | Command Class | XOR / CRC-16 |
| Frame Field | Field Size | Functional Role & Wire Protocol Detail |
|---|---|---|
| Preamble | 10–24 Bytes | Continuous alternating 0101 bit sequence to allow receiver AGC settling and symbol clock recovery |
| SOF (Start of Frame) | 1 Byte | Hardware frame delimiter (0x0F for 9.6/40 kbps, 0xF055 for 100 kbps GFSK) signaling start of MAC data |
| Home ID | 4 Bytes | 32-bit unique network identifier assigned by the primary controller; separates adjacent neighboring networks |
| Source Node ID | 1 Byte (Classic) / 2 Bytes (LR) | Node ID of the transmitting device (1–232 for Classic mesh, 1–4000 for Z-Wave Long Range) |
| Frame Control | 1–2 Bytes | Frame type (Singlecast, Broadcast, Multicast, ACK), routed hop flags, and header length options |
| Length | 1 Byte | Total length of the payload and subsequent header fields in bytes |
| Destination Node ID | 1 Byte (Classic) / 2 Bytes (LR) | Node ID of target recipient or 0xFF for unencrypted network broadcast |
| Payload (Command Class) | Var (up to 64B) | Application layer command class, command byte, and structured parameter payload |
| Checksum / CRC-16 | 1–2 Bytes | XOR checksum (9.6/40 kbps) or CRC-16-CCITT (100 kbps and ZWLR). Errored packets dropped in hardware |
02 · Command Classes (CC) & Application Layer
Z-Wave standardizes device behaviors using modular Command Classes. Every device exposes a Node Information Frame (NIF) listing supported classes so the hub controller knows exactly how to query and command it:
COMMAND_CLASS_BASIC (0x20)
The universal fallback class. A value of 0x00 turns off, while 0xFF turns on or opens to full scale.
COMMAND_CLASS_SWITCH_BINARY (0x25)
Controls physical relays, contactors, and smart wall switches with explicit Set, Get, and Report command frames.
COMMAND_CLASS_SENSOR_MULTILEVEL (0x31)
Encodes high-precision sensor telemetry (temperature, humidity, atmospheric pressure, power watts) with precision scales and signed byte encodings.
COMMAND_CLASS_DOOR_LOCK (0x62)
Electronic deadbolt and security actuator controls; strictly encapsulated within Security 2 (S2) Access Control encryption.
03 · Security 2 (S2) Cryptographic Architecture
Legacy Z-Wave Security 0 (S0) suffered from serious design flaws: it required three round-trip nonce handshakes for every single encrypted frame (destroying battery life and causing noticeable command lag) and exposed network keys during inclusion if an observer captured the plain-text exchange.
Security 2 (S2) replaced S0 with modern cryptographic primitives:
- Key Exchange: Elliptic Curve Diffie-Hellman (ECDH) on Curve25519 ensures forward secrecy during secure inclusion.
- Authenticated Encryption: AES-128-CCM (Counter with CBC-MAC) provides both confidential data encryption and 8-byte Message Authentication Code (MAC) integrity protection.
- Single-Frame Delivery: S2 maintains synchronized pseudo-random sequence generators between nodes, allowing encrypted commands to be delivered in a single over-the-air frame with zero round-trip latency.
| S2 Security Class | Class Identifier | Key Exchange Requirement & Target Devices |
|---|---|---|
| S2 Unauthenticated | 0x01 | No PIN/DSK verification during inclusion. Used for simple sensor devices lacking physical interfaces where rogue impersonation risk is low. |
| S2 Authenticated | 0x02 | Requires entering or scanning the 5-digit Device Specific Key (DSK) PIN printed on the device chassis. Prevents rogue node injection on wall switches and plugs. |
| S2 Access Control | 0x04 | Highest privilege tier. Reserved for electronic door deadbolts, garage door openers, and security barriers with strict authentication checks. |
04 · Z-Wave Long Range (ZWLR): The Star Topology Shift
While classic Z-Wave connects devices through a repeating mesh limited to 4 hops and 232 nodes, Z-Wave Long Range (ZWLR) completely eliminates the mesh in favor of a direct point-to-point star topology:
4,000 Node Capacity
Node IDs expand from 8-bit (1–232) to 12-bit (1–4000), allowing massive commercial facilities, apartment complexes, and hotels to operate under a single controller.
1-Mile Line-of-Sight Range
Operating under FCC Part 15.247 rules on 912 MHz and 920 MHz with up to +30 dBm (1 W) conducted power, ZWLR communicates across outdoor properties and perimeter gates without relay nodes.
Dynamic Power Control (DPC)
The gateway measures link quality on every packet and instructs the battery node to throttle transmit power to the exact minimum needed. This prevents spectrum saturation and extends coin-cell battery life up to 10 years.
05 · Automation Protocol Comparison
How Z-Wave and ZWLR compare against competing smart home wireless protocols:
| Protocol | RF Band | Topology | Max Nodes | Wi-Fi Coexistence | Line-of-Sight Range | Security Stack | Ideal Field Application |
|---|---|---|---|---|---|---|---|
| Z-Wave Classic | Sub-1GHz (908/868 MHz) | 4-Hop Mesh | 232 | Zero Interference (Sub-1GHz) | 30–100 m / hop | Security 2 (S2 AES-CCM) | Whole-home reliable residential automation |
| Z-Wave Long Range | Sub-1GHz (912/920 MHz) | Star (Direct to AP) | 4,000 | Zero Interference (Sub-1GHz) | 1.6+ km (1 mile) | Security 2 (S2 AES-CCM) | Large estates, perimeter gates, commercial facilities |
| Zigbee / Thread | 2.4 GHz (802.15.4) | Full Mesh | Hundreds | Shares 2.4 GHz spectrum (needs Ch 15/20/25) | 10–30 m / hop | AES-128-CCM | Smart bulbs, sensors, Matter cross-vendor ecosystem |
| Bluetooth LE Mesh | 2.4 GHz | Managed Flood Mesh | 32,767 | Heavy 2.4 GHz frequency hopping contention | 10–20 m / hop | AES-128-CCM (Dual-layer) | Commercial architectural lighting controls |