Z-Wave Protocol Guide: Smart Home Mesh & Diagnostics

Core Technical Specifications

center Freq US: 908.42 MHz / EU: 868.42 MHz

modulation FSK / GFSK

data Encoding 9.6 / 40 / 100 kbps (Gen5/Gen7)

operating Range 30–100 m (mesh extends)

antenna PCB trace or wire

tx Power 0–14 dBm

bandwidth ~300 kHz

channel Spacing Single frequency per region

Real-World Devices & Applications

Smart Home

Smart locks (Yale, Schlage, Kwikset)
Smart thermostats (Honeywell, Trane)
Dimmer switches and relays (Aeotec, Zooz, Inovelli)
Water/leak sensors, smoke detectors
Garage door controllers (GoControl, Linear)

Reference Circuits & Schematics

Z-Wave Module — 700/800 Series

Silicon Labs ZGM130S (700 series) and ZG23 (800 series) are the latest Z-Wave SoCs with S2 security, SmartStart, and Long Range support.

Pin	Description
`VCC`	1.8–3.6V supply
`GND`	Ground
`UART`	Serial interface to host controller
`GPIO`	Button inputs, LED outputs
`ANT`	PCB trace antenna

Circuit Walk-Through

Z-Wave operates on a single sub-GHz frequency per region, avoiding 2.4 GHz congestion. Every mains-powered node acts as a mesh repeater. The controller maintains a routing table and can route messages through up to 4 hops. S2 security framework (mandatory since 2017) uses ECDH key exchange and AES-128-CCM encryption. Z-Wave LR (800 series) adds 1+ mile range at 100 kbps.

Signal Structure & Waveform Analysis

Z-Wave Mesh Routing

Z-Wave uses source routing with the controller maintaining the network topology.

Home ID

32 bits

Network identifier (unique per controller)

Node ID

8 bits (232 max)

Device address within network

Command Class

Variable

Defines device capabilities (Switch Binary, Sensor Multilevel, etc.)

S2 Encryption

AES-128-CCM

Authenticated encryption with nonce

Timing Notes: Max 232 devices per network. Messages routed through up to 4 hops. Last Working Route (LWR) cached for speed. Explorer frames used when routes fail. SmartStart allows out-of-box inclusion via DSK QR code.

Analysis & Capture Tips

Use Z-Wave JS or Zniffer for protocol analysis
Check routing table for failed routes (dead nodes)
Monitor S2 security class of each device (S2 Authenticated, S2 Unauthenticated, S0)
Verify firmware update status for security patches

Bench Troubleshooting & Repair Guide

1. Inclusion Failure

Controller inclusion log

Bring device within 1 m of controller for inclusion. Reset device to factory first. Check S2 DSK if prompted. Verify controller firmware supports device’s Z-Wave generation.

2. Unresponsive Devices

Z-Wave JS network heal / route map

Check routing table — device may be routing through a removed node. Heal network to rebuild routes. Verify device is powered and within mesh range.

3. Range Issues

Network topology map

Sub-GHz frequency provides good wall penetration but range depends on mesh density. Add mains-powered devices (smart plugs) as repeaters in weak areas.

Z-Wave