Prof.Dr.H.Ziegler CEN/TC176-WG4-N107 Rev.4

The original EN1434-3 defined two possible data sequences in multibyte records. The bit two (value 4), which is called M bit or Mode bit, in the CI field gives an information about the used byte sequence in multibyte data structures. If the Mode bit is not set (Mode 1), the least significant byte of a multibyte record is transmitted first, otherwise (Mode 2) the most significant byte. The Mode 2 (M=1) is obsolete and should not be used. It is documented here only as a reference for universal master software with support of old meters.

Mode 1	(Mode 2)	Application
00h-4Fh		reserved for DLMS
50h		application reset
51h	(55h)	data send (master to slave)
52h	(56h)	selection of slaves
53h		reserved
54h-58h		reserved for DLMS
59h-5Bh		reserved
5Ch		synchronize action
60h-6Fh		reserved
70h-7Fh	(74h)	reserved for answer directionslave to master: report of application errors
71h		slave to master: report of alarms
72h	(76h)	slave to master: Variable format data respond
73h	(77h)	slave to master: Fixed format data respond
7880h-8Fh		reserved
90h-97h		manufacturer specific (obsolete)
A0h-AFh		manufacturer specific
B0-B7h		manufacturer specific (obsolete)
B8h		set baudrate to 300 baud
B9h		set baudrate to 600 baud
BAh		set baudrate to 1200 baud
BBh		set baudrate to 2400 baud
BCh		set baudrate to 4800 baud
BDh		set baudrate to 9600 baud
BEh		set baudrate to 19200 baud
BFh		set baudrate to 38400 baud
C0h-FFh		reserved

Table 1 CI-Field codes used by the master

"Reserved for DLMS" refers to the DLMS PDU´s in A-XDR encoding of the FDIS version of the IEC-DLMS standard. Choosing CI-fields different from these code simplifies the construction of slaves which can have dual application layers for both standards and which then can automatically distinguish between communication according to both standards.

Note that the CI-codes $50, $52/$56, $5C, $70/$74, $71, $A0-$AF and $B8-$BF are optional compatible enhancements of the original standard. Note also that even if the functions of these optional CI-codes are not implemented in a slave the link layer protocol requires a proper link layer acknowledge of SND_UD telegrams containing any of these CI-codes.

With the CI-Code $50 the master can release a reset of the application layer in the slaves. Each slave himself decides which parameters to change - e.g. which data output is default - after it has received such an application reset. This application reset by a SND_UD with CI=$50 is the counterpart to the reset of the data link layer by a SND_NKE.

It is allowed to use optional parameters after CI = $50. If more bytes follow, the first byte is the application reset subcode. Further bytes are ignored. The application reset subcode defines which telegram function and which subtelegram is requested by the master. The datatype of this parameter is 8 bit binary. The upper 4 bits define the telegram type or telegram application and the lower 4 bits define the number of the subtelegram. The lower four bits may me ignored for slaves which provide only a single telegram for each application. The use of the value zero for the number of the subtelegram means that all telegrams are requested.

Slaves with only one type of telegram may ignore application reset and the added parameters but have to confirm it ($E5).

The following codes can be used for the upper 4 bits of the first parameter:

Table 2 Coding of the upper four bits of the first parameter after CI = $50

Note that this table has been expanded with optional elements from the original standard.

The CI-Field codes 51h(55h) are used to indicate the data send from master to slave:

Fig. 1 Variable Data Structure master to slave

Note that this structure is identical to the slave to master direction (see chapter 4) with the exception of the fixed header which is omitted in this direction.

The CI-Field codes 52h(56h) are used for the management of an optional netwerk layer using secondary adressing (See chapter 9).

This CI-code can be used for synchronizing functions in slaves and masters (e.g. clock synchronization). Special actions or parameter loads may be prepared but their final execution is delayed until the reception of such a special CI-field command.

The following codes can be used for the direction slave to master:

Table 3 CI-Field codes used by the slave

The use of these control information codes is described in the chapters 3 (fixed data respond), 4 (variable data respond), 6.6 (report of general application errors) and 8.1 (report of alarm status).

For details of the report of application errors see chapter 6.

For details of the report of alarm status errors see appendix C.

In the reply direction (slave to master) with a long frame originally two different data structures were used. The fixed data structure, besides a fixed length, is limited to the transmission of only two counter states of a predetermined length, which have binary or BCD coding. In contrast the variable data structure allows the transmission of more counter states in various codes and further useful information about the data. The number of bytes of the transmitted counter states is also variable with this data structure. Contrary to the fixed structure, the variable structure can also be used in calling direction. For theseis reasons the fixed data structure is not recommended for future developments. For information on this obsolete fixed data structure see appendix D. For new development therefore only the CI-field $72 shall be used. This is a restriction from the original standard.

To identify the fixed data structure, the numbers 73h/77h for the control information field are used. In this way a universal master software can see how it must interpret the data. For further details on the structure of telegrams starting with CI-values of $72/($76) see chapter 3.

These optional commands can be used by a master to switch the baudrate of a slave.
For details see chapter 9.1.

The CI-Field codes 72h/(76h) are used to indicate the variable data structure in long frames (RSP_UD). Figure 2 1 shows the way this data is represented:

Fig. 12 Variable Data Structure in Answer Direction

The first twelve bytes of the user data consist of a block with a fixed length and structure (see fig. 32).

Fig. 23 Fixed Data HeaderBlock

The Identification Number is either a fixed fabrication number or a customer number changable by the customer, coded with 8 BCD packed digits (4 Byte), and which thus runs from 00000000 to 99999999. It can be preset at fabrication time with a unique number, but could be changeable afterwards, especially if in addition an unique and not changeable fabrication number (DIF = $0C, VIF = $78, see chapter 6.7.3) is provided.

The field manufacturer is coded unsigned binary with 2 bytes. This manufacturer ID is calculated from the ASCII code of EN 61107 manufacturer ID (three uppercase letters) with the following formula:

Note that currently the flag association administers these three letter manufacturers ID of EN61107. For details see appendix X.

The field version specifies the generation or version of the meter and depends on the manufacturer. It can be used to make sure, that within each version number the identification # is unique.

The medium device byte is coded as follows:

Note that this table has been expanded with optional elements from the original standard.

The Access Number has unsigned binary coding, and is increased (modulo 256) by one before or after each RSP_UD from the slave. Since it can also be used to enable private end users to detect an unwanted overfrequently readout of its consumption meters, it should not be resettable by any bus communication.

Table 5 Fig. 4 Application Errors coded with the Status-Field

Note that more detailed error signalling can be provided by application telegrams starting with CI=$70 and/or using data records signalling even more detailed error information.

The Signature is reserved for optional encryptation of the application data. If no encryptation is used its value shall be 00 00 h.

3.8.1 Functions

Data privacy for consumption meters values

Detecting simulated meter transmission

Preventing later playback of old meter values

3.8.2 Structure of encrypted telegrams

a) The first 12-byte block containing the ID-number,

the manufacturer etc. is always unencrypted.

The last word of this block is the signature word.

If the following data are unencrypted, this

signature word contains a zero.

b) If the transmission contains encrypted data,

the high byte of this signature word contains a code for

the encryptation method. The code 0 signals no

encryptation. Currently only the encryptation codes 2 or 3

(see below) are defined. The other codes are

reserved. The number of encrypted bytes is contained

in the low byte of the signature word.

The content of this signature word is currently defined

as zero, corresponding consistently to no encrypted data.

c) The encrypted data follow directly after the

signature word, thus forming the beginning of the

DIF/VIF-structured part of the telegram.

3.8.3 Partial Encryption

a) If the number of encrypted bytes is less than the

remaining data of the telegram, unencrypted data may

follow after the encrypted data. They must start at a

record boundary, i.e. the first byte after the encrypted

data will be interpreted as a DIF.

b) If a partially encrypted telegram must contain encrypted

manufacturer specific data a record with a suitable length

DIF (possibly a variable length string DIF) and a VIF=

$7F (manufacturer specific data record) must be used

instead of the usual MDH-DIF=$0F. This is required to

enable after decryptation standard DIF/VIF-decoding of a previously partially encrypted telegram containing

encrypted manufacturer specific data .

3.8.4 Encryptation methods

a) Encryptation according to the DES (data encryptation

standard) as described in ANSI X3.92-1981

b) Cipher Block Chaining (CBC)-method as described in

ANSI X3.106-1983 with an initial initialization vector

of zero: (Encryptation Method Code=2). In this case

the data records should contain the current date

before the meter reading.

Note that in this case the data after the date record,

i.e.especially the encrypted meter reading data

change once per day even if their data content itself is

constant. This prevents an undetectable later playback of

stored encrypted meter readings by a hacker.

c) The "Initialization Vector IV" with length 64 bits of this

standard may alternatively be defined by the the first 6

bytes of the identification header in mode 1 sequence,

i.e. identification number in in the lowest 4 bytes

followed by the manufacturer ID in the two next higher

bytes and finally by the current date coded as in record

structure "G" for the two highest bytes.

In this case the encryptation method is coded as "3".

Note that in this case all encrypted data change once

per day even if the data content itself is constant.

This prevents an undetectable later playback of any

stored encrypted data by a hacker.

d) To simplify the verification of correct decoding and to

e) Due to the mathematical nature of the DES-algorithm

the encrypted length contained in the low byte of the

signature word must be an integer multiple of 8 if

the high byte signals DES-encryptation.

Unused bytes in the last 8-byte block must be filled

with appropriatly structured dummy data records to

achieve the required record boundary at the end of the

encrypted data. One or several bytes containing the filler

DIF=$2F are suggested to fill such gaps.

f) The application of certain encryptation methods might be

prohibited by local laws.

The Signature remains reserved for future encryptation applications, and until then is allocated the value 00 00 h.

The data, together with information regarding coding, length and the type of data is transmitted in data records in arbitrary sequence. As many records can be transferred as there is room for within the maximum total data length of 234255 Bytes, and taking account of the C, A, and CI fields, and the data header. This limits the total telegram length to 255 bytes. This restriction is required to enable gateways to other link- and application layers. e upper limit for characters in the variable data blocks is thus 240 byte. A maximum total telegram length of 255 bytes (234 bytes for variable data blocks) is recommended to simplify gateways and the integration in other link layers . The manufacturer data header (MDH) is made up by the character 0Fh or 1Fh and indicates the beginning of the manufacturer specific part of the user data and should be omitted, if there are no manufacturer specific data.

Fig. 46 Structure of a Data Record (transmitted from left to right)

Each data record contains one value (data) with its description (DRH)as shown in figure 20, a data record, which consists of a data record header (DRH) and the actual data. The DRH in turn consists of the DIB (data information block) to describe the length, type and coding of the data, and the VIB (value information block) to give the value of the unit and the multiplier.

The DIB contains at least one byte (DIF, data information field), and can be extended by a maximum of ten DIFE's (data information field extensions).

The following information is contained in a DIF:

Fig. 57 Coding of the Data Information Field (DIF)

The data field shows how the data from the master must be interpreted in respect of length and coding. The following table contains the possible coding of the data field:

Table 46 Coding of the data field

Note that this table has been expanded with optional elements from the original standard.

For a detailed description of data types refer to appendix A8.2 " Coding of data records"
(e.g. BCD = Type A, Integer = Type B, Real = Type H).

With data field = `1101b` several data types with variable length can be used. The length of the data is given after the DRH with the first byte of real data, which is here called LVAR (e.g. LVAR = 02h: ASCII string with two characters follows).

Like all multibyte fields in mode 1 the last character and in mode 2 the first character is transmitted first.

Table 7: DIF-coding for special functions

Note that this table has been expanded with optional elements from the original standard.

If data follows after DIF=$0F or $1F these are manufacturer specific unstructured data. The number of bytes in these manufacturer specific data can be calculated from the link layer information on the total length of the application layer telegram. The DIF 1Fh signals a request from the slave to the master to readout the slave once again. The master must readout the slave until there is no DIF=1Fh inside the respond telegram (multi telegram readout) or use an application reset.

The function field gives the type of data as follows:

Table 8: Function Field

The Bit 6 of the DIF serves as the LSB of the storage number of the data concerned, and the slave can in this way indicate and transmit various stored metering values or historical values of metering data. This bit is the least significant bit of the storage number and allows therefore the storage numbers 0 and 1 to be coded. If storage numbers higher than "1" are needed, following (optional) DIFE´s contain the higher bits. The storage number 0 signals an actual value. Note that a each storage number is associated with a given timepoint. So all data records with the same storage number refer to the value of the associated variable at this (common) timepoint for this storage number. It is recommended, that a time/date record with this storage number is included somewhere to signal this timepoint. Normally (but not necessarily) higher storage numbers indicate an older timepoint. A sequential block of storage numbers can be associated with a sequence of equidistantly spaced time points (profile). Such a block can be described by its starting time, by the time spacing, by the first storage number of such a block and by the length of such a block. The coding for such a block description in contrast to an individual time/date record for each individula storage number is given in the appendix.

The extension bit (MSB) signals that more detailed or extended descriptions (data field extension=DIFE)-bytes follow.

Each DIFE (maximum ten) contains again an extension bit to show whether a further DIFE is being sent. Besides giving the next most significant bits of the storage number, DIFE´s allow the transmission of informations about the tariff and the subunit of the device from which the data come. In this way, exactly as with the storage number, the next most significant bit or bits will be transmitted. The figure 8 which follows shows the structure of a DIFE:

Fig. 58 Coding of the Data Information Field Extension (DIFE)

With the maximum of ten DIFE´s which are provided, there are 41 bits for the storage number, 20 bits for the tariff, and 10 bits for the subunit of the meter. There is no application conceivable in which this immense number of bits could all be used.

For each (unique) value type designation given by the following value information block (VIB) at each unique time point (given by the storage number) of each unique function (given by the function field) there might exist still various different data, measured or accumulated under different conditions. Such conditions could be time of day, various value ranges of the variable (i.e. separate storage of positive accumulatad values and negative accumulated values) itself or of other signals or variables or various averaging durations. Such variables which could not be distinguished otherwise are made different by assigning them different values of the tariff variable in their data information block. Note that this includes but is not necessarily restricted to various tariffs in a monetary sense. It is at the distinction of the manufacturer to describe for each tariff (except 0) what is different for each tariff number. Again as with the storage numbers all variables with the same tariff information share the same tariff associating condition.

A slave component may consist of several functionally and logically independent subunits of the same or of different functionallity. Such a device may either use several different primary and/or secondary adresses. Such it is from a link layer and an application layer view just several independent devices which share a common physical layer interface. This is recommended for devices which represent a physical collection of several truely independent (often similar or idential) devices. For devices which share common information and values and have logical connections an approach with a common link layer (i.e.a single address) is reccomended. The various subunits can include their specific information into a common telegram and have them differentiated by the individual subunit number in the subunit-datafield of their records.

After a DIF (with the the exception of $xF) or a DIFE without a set extension bit there follows the VIB (value information block). This consists at least of the VIF (value information field) and can be expanded with a maximum of 10 extensions (VIFE). The VIF and also the VIFE's show with a set MSB that a VIFE will follow. In the value information field VIF the other seven bits give the unit and the multiplier of the transmitted value.

Fig. 69 Coding of the Value Information Field (VIF)

The first section of the main table contains integral values, the second typically averaged values, the third typically instantaneous values and the fourth block contains parameters (E: extension bit).

Table 9: Primary VIF-codes

Note that this table has been expanded with optional elements from the original standard.

Table 10: Special VIF-Codes

Note that this table has been expanded with optional elements from the original standard.

Note that this optional table has been added to the original standard.

Πnn = 00 second(s)

01 minute(s)

10 hour(s)

11 day(s)

 The information about usage of data type F (date and time) or data type G (date) can be derived from the datafield (0010b: type G / 0100: type F).

Ž pp = 00 hour(s)

01 day(s)

10 month(s)

11 year(s)

Note that this optional table has been added to the original standard.

Note that this optional table has been added to the original standard.

Π"Date(/time) of" or "Duration of" relates to the information which the whole data record header contains.

 The information about usage of data type F (date and time) or data type G (date) can be derived from the datafield (0010b: type G / 0100: type F).

The data link layer reports only communication errors by means of omittingleaving out the acknowledgement $E5 or a via a negative acknowledgement. It is not allowed to report errors of the application layer (which can occur for example in data writing) via the link layer. The slave can transmit an $E5 after a SND_UD to indicate that it has received the telegram, but can´t respond with data. There are three different techniques for reporting application errors:

The fundamental idea of an object is the encapsulation of data and methods or actions for the data. In case of writing data to a slave the master software can pack data and information about the action, which the slave shall do with this data, in one data record. This variable data record with actions is now called an object. Following any VIF including a VIF=$FD or VIF=$FB with the true value information in the first VIFE another (usually the last) VIFE can be added which contains a code signalling object actions according to the following table.

Action: (E: extension bit)

Fig. 7 Table 17: Action Codes for the Generalized Object layer (Master to Slave)

Note that this optional table has been added to the original standard.

The object action "write / replace" (VIFE = E000 0000) is the default and is assumed if there is no VIFE with an object action for this record.

The MDH consists of the character 0Fh or 1Fh (DIF = 0Fh or 1Fh) and indicates that all following data are manufacturer specific. When the total number of bytes given from the link/network layers and the number of record-structured bytes and the length of the fixed header is known, the number of remeining unstructured manufacturer specific bytes can be calculated.

Note that stuctured manufacturer specific data (i.e. those with a known data structure including variable length binary or ASCII but with a manufacturer specific meaning or unit) can be described using normal data records with a value information field of VIF=E1111111b.

In case of MDH = 1Fh the slave signals to the master that it wants to be readout once again (multitelegram readouts). The master must readout the data until there is no MDH = 1Fh in the respond telegram.

Because changing of parameters like baudrate and address by higher layers is not allowed in the ISO-OSI-Model, a Management Layer beside and above the seven OSI-Layers is defined:

All slaves must be able to communicate with the master using the minimum transmission speed of 300 baud. , after reception of a break signal and after each bus power fail.Split baudrates between transmit and receive are not allowed, but there can be devices with different baudrates on the bus.

In point to point connections the slave is set to another baudrate by a Control Frame (SND_UD with L-Field = 3) with address FEh and one of the following CI-Field codes: Note that for safety reasons a baudrate switch command to the (unacknowledged) broadcast adress 255 is not recommended.

A complete bus can be switched to another baudrate via the broadcast adress $FF.

Fig. 9 CI-Field-Codes for Baudrate Switching

Note that this optional figure has been added to the original standard.

Notes:

1) These baudrates are not recommended only by agreement with operator.

The slave always confirms the correctly received telegram by transmitting an E5h with the old baudrate and uses the new baudrate from now on, if he is capable of this. Otherwise the slave stays at ists previous baudrate after the $E5 acknowledge. To make sure that a slave without autospeed detect has properly switched to the new baudrate and that it can communicate properly at the new baudrate in its segment it is required that after a baudrate switch to a baudrate other than 300 Baud the master attempts imediately (<2min) after the baudrate switch command a communication. If (even after the appropriate number of retries) this is not acknowledged by the slave, the master shall issue a baudrate set command (at the attempted new baudrate) back to the previous baudrate. If a slave without autospeed detect does not receive a valid communication at the new baudrate within 2-10 minutes of the baudrate switch command the slave must fall back to its previous baudrate. This is required individually and sequentially for each adressable slave.

The master must know the highest available baudrate on the bus to forbid the user switching to a transmission speed, which is not available on the bus. Otherwise the slave would never answer again. In this case intelligent primary level converters or bridges (with special address = 251) can generate a break signal on the bus if they receive a SND_UD-telegram with a CI-field of $B0.

For compatibility with older slaves with fallback to 300 baud the master should also attempt a communication at 300 baud if the slave does not answer at its last baudrate.

The network layer takes care of choosing the best transmission route between the communication parties in a network. We define that the network layer in the M-Bus protocol "connects" a slave with a certain secondary address to the bus and and associates it with the primary address of 253 ($FD). So the maximum number of 250 addresses (primary) is extended by the network layer associating a selected slave to this address 253. The network layer is only enabled by a SND_UD with CI_Field $52 / $56 to address 253.

When addressing in the data link layer with the help of the A-Field, the problem of the address allocation could arise. The addresses are normally set to a value of 0 by the manufacturer of the meters, in order to designate them as unconfigured slaves. A very laborious method of address allocation consists of setting the addresses when installing the slaves, for example with DIP switches. A further method of address allocation is to determine the bus addresses when connecting the equipments to the bus with the master software. This sends a command for address allocation (see 6.4.2Appendix E2) to the address 0. In this case the slaves must however all be successively connected to the bus, which very much gets in the way of a simple installation procedure.

When however addressing in the network layer these disadvantages are avoided and the address region is essentially extended beyond the number of 250 with primary addressing (A-Field). The addressing of the slaves takes place with secondary addressing with the help of the following so-called selection:

Fig. 10 Structure of a telegram for selecting a slave (mode 1)

The master sends a SND_UD with the control information 52h (Mode 1) or 56h (Mode 2 ) to the address 253 (FDh) and fills the specific meter secondary address (identification number, manufacturer, version and device typemedium) with the values of the slave which is to be addressed. After the reception of the address FDh the selection mode is entered. If then the proper CI-selection code (normally CI=52h, i.e. mode 1) is received the internal selection bit is set otherwise it is reset. If further data bytes follow they are compared with the corresponding internal addresses respective values of the meter. If they disagree, the selection bit is cleared otherwise it is left unchanged. Thus "selecting" a meter with only a proper CI-field and no further data will select all meters on the bus capable of secondary addressing. A set selection bit means that this slave can be addressed (e.g. REQ_UD) with the bus address FDh and in this example will reply with RSP_UD. In other words the network layer has associated this slave with the address FDh.

During selection individual positions of the secondary addresses can be occupied with wildcards (Fh). Such a Wildcard means that this position will not be taken account of during selection, and that the selection will be limited to specific positions, in order to address complete groups of slaves (Multicasting). In the identification number each individual digit can be wildcarded by a wildcard nibble Fh while the fields for manufacturer, version and device typemedium can be wildcarded by a wildcard byte FFh.

The state of the selection remains unchanged until the slave is deselected with a selection command (as described above) with non-matching secondary addresses, or a SND_NKE to address 253. The slave, which uses mode 1 for multibyte records, will be selected by a telegram with the CI-Field 52h and the right secondary address, but it will be deselected by a telegram with the CI-Field 56h and any secondary address.

A sSlave with implemented primary and secondary addressing should also answer telegrams to his primary address. A sSlave with only secondary addressing (i.e. internal primary adress=253) should occupy the address field in the RSP_UD telegram with $FD to signal that it will not participate in primary addressing.

For including new or restructed identification parameters into a selection procedure an enhanced definition of the selection telegram (CI=$52/$56) can be used:

After the 8 byte of the fixed selection header may also follow standard records with data. In this case only those meters will be selected, where in addition to the fixed header all record data agree. In most but not all cases this means that the DIF and parts of the VIF (not exponent) must match. Again wildcard rules apply to the record data (digit wildcard for BCD-coded data and byte wildcard for binary or string data).

With this generalized selection it will be possible to select slaves using e.g. additional fabrication number, longer identification numbers, customer, customer location and more information. Two useful examples from the primary table for VIF´s are the "Fabrication No." and "Customer name". For inclusion of the fabrication number in the selection process

after the field "device type" the 8-digit BCD-fabrication number follow. Parts of the fabrication number (Fab1..Fab4) can be occupied with wildcards (Fh).

If a fabrication number exists the slave should add this data to the variable data blocks in every RSP-UD telegram. If the fabrication number and enhanced selection is not implemented in a slave this device will not confirm the enhanced selection telegram and will be deselected.

Enhanced selection should be used only if the normal kind of selection is not successful.

To read out all installed slaves the master software must know all the slaves, which are connected to the bus. Therefore the software searches for slaves with primary adressing by sending a REQ_UD2 to all allowed adresses (1..250) with all available baudrates. The master notes used primary addresses with the respective baudrates.

The secondary addressing described in the preceding section draws attention to the problem of determining the secondary addresses of slaves connected to the bus. The master can after this read out the slaves making use of secondary addresses with previous selection. Testing all possible identification numbers with the master software would take years, since the identification number offers millions of combinations. For this reason, a procedure was developed for the rapid and automatic determination of already installed slaves:

The following wildcard searching procedure uses the occupation of individual parts of the secondary address with wildcards (Fh) for selection:

In this case with the identification number (BCD) each individual position, and by manufacturer, version and medium (binary coding), only one complete byte, can be occupied with wildcards. The master begins the selection using a SND_UD with the control information 52h (Mode 1), and occupies all positions in the identification number, except the top one, with wildcards. The top position is run through in ten selections from 0 to 9 (0FFFFFFF to 9FFFFFFF).

If after such a selection the master receives no acknowledgement, it then goes to the next selection. If the master receives an E5h, it then sends a REQ_UD2 and learns the secondary address of the slaves from the reply telegram, as long as no collision occurs. If there is a collision after the selection or the REQ_UD2, the master varies the next positions and holds the existing one. If there is a collision, for example at 5FFFFFFF, the selection is run through from 50FFFFFF to 59FFFFFF. If in this case collisions again occur, then a change is made to a variation of the next position. After running through a complete position, the next higher position is processed up to 9.

With this Wildcard searching procedure, it will be seen that at least the top position must be run through in order to reach all slaves. Running through further positions may be necessary, depending on the number of the slaves and the distribution of the identification numbers. This procedure allows a statement of the maximum number of selections in relation to the number of slaves, but as disadvantage frequent collisions, which occur, should be mentioned. The wildcard searching procedure must be performed for all used baudrates and both byte sequences (mode 1 and 2).

The search procedure can be extended with searching for manufacturer, generation and finally device typesmedia to find slaves, which have the same identification number. It is also possible to search for all slaves of a certain manufacturer or all slaves of a certain device typemedia by setting the corresponding value. With extended selection meters which differ only in their manufacturer specific fixed fabrication number can be distinguished.

1.) Standard Reference

This standard allows multi-digit BCD-coded datafields. It does however not contain information about what happens if a non-BCD hex code ($A-$F) is detected by the master software.

To fully define a master software including error treatment such a definition would be desirable.

The current user group proposal contains various techniques for signalling errors or abnormal situations. Most of them are hard to implement on weak mikro-processors. Utilizing these "illegal" codes $A to $F for signalling these states to the master would simplify the software design of the slaves.

• Value not available

• Device error

• Soft overflow

• Soft underflow

• Simple visible error signalling

1.) Definition of hex code meanings

Such a code in the MSD (Most significant digit) position signals a one digit value overflow either of a number or due to an addition or increment carry. The display at the meter or a remote PC should display a "0" at the appropriate display position. This makes the display compatible with conventional counter rollover. In addition the leading digit can be treated by the slave software simply as a hexadecimal digit instead of the BCD-coded other digits to realize this function. Processing software in the master could convert this data digit to a value of 10 in an extended length data field. In addition an appropriate application error code could be generated if desired. If this hex code appears in any other digit position than the MSD, it signals a value error of the complete data field. If an alternative display decoding table for the digits other than the MSD is possible, this hex code should be displayed in these other digit positions as the symbol "A". This would allow more flexible displayable error codes.

Such a code in the MSD digit position signals a two digit value overflow either of a number or due to an addtion or increment carry. The display at the meter or a remote PC should display a "1" at the appropriate display position. This makes the display compatible with conventional counter rollover. In addition the leading digit can be treated by the slave software simply as a hexadecimal digit instead of the BCD-coded other digits to realize this function. Processing software could convert this data digit to a value of 11 in an extended length data field. In addition an appropriate application error code could be generated if desired. If this hex code appears in any other digit position than the MSD, it signals a value or availability error of the complete data field. It should be displayed as the symbol "-".

Such a code in the MSD digit position signals a three digit value overflow either of a number or due to an addition or increment carry. The display at the meter or a remote PC should display a "2" at the appropriate display position. This makes the display compatible with conventional counter rollover. In addition the leading digit can be treated by the slave software simply as a hexadecimal digit instead of the BCD-coded other digits to realize this function. Processing software could convert this data digit to a value of 12 in an extended length data field. In addition an appropriate application error code could be generated if desired. If this hex code appears in any other digit position than the MSD, it signals a value error of the complete data field. It should be displayed as the symbol "C". Note that the suggested interpretation of $A to $C in the MSD effectivly supports a 30% overrange guard band against an undetected rollover and flexible error codes including the letters "A", "C", "E" and "F".

Such a code in any digit position signals a general error of the complete data field. The display at the meter or a remote PC should display an appropriate symbol blank at the appropriate display position. Since both an overflow from $C and an underflow from $E end in this out of range type error the function of an out-of-range over/underflow can be implemented by simple hex arithmetic. It is however recommended that the slave arithmetic checks this $D-code in the MSD before incrementing or decrementing the value for integral variables to make such an error irreversible if the slave does not expect such an over- or underflow.

Such a code in the MSD digit position signals a two digit value underflow either of a number or due to a subtraction or decrement borrow. The display at the meter or a remote PC should display an "8" at the appropriate display position. This makes the display compatible with conventional counter rollunder. In addition the leading digit can be treated by the slave software simply as a hexadecimal digit instead of the BCD-coded other digits to realize this function. Processing software could convert the data in the field to a negative value using 16´s complement on the leading digit and tens complement at the other digits. In addition an appropriate application error code could be generated if desired. If this hex code appears in any other digit position than the MSD, it signals a value error of the complete data field. It should be displayed as the symbol "E".

Such a code in the MSD digit position signals a "minus-sign" in front of the remaining (N-1) digit number. In any other digit position it signals an error.n one digit value underflow either of a number or due to a subtraction or decrement borrow. The display at the meter or a remote PC should display an "9" at the appropriate display position. This makes the display compatible with conventional counter rollunder. In addition the leading digit can be treated by the slave software simply as a hexadecimal digit instead of the BCD-coded other digits to realize this function. Processing software could convert the data in the field to a negative value using 16´s complement on the leading digit and tens complement at the other digits. In addition an appropriate application error code could be generated if desired. If an alternative display decoding table for the digits other than the MSD is possible, this hex code should be displayed in these other digit positions as the symbol "F". Note that the suggested interpretation of $E and $F in the MSD effectivly supports a 20% underrange guard band against an undetected rollunder for displays and flexible error displays if dual decoding tables are available. In addition it allows a simplified coding for small negative values as often required for values like temperature or flow rate.

g) Combinations

If with the exception of the MSD all other digits are true BCD-digits ($0-$9) the value is either considered as "Overflow" for the MSD hex codes $A to $C or as "Underflow" for the MSD hex codes $E and $F or a general error for the MSD hex code $D.

The code $DBB.. in the data field is always considered as "not available". This is displayed as " ----" (with a blank in the MSD). Any other non BCD-hex codes in one or several digits other than the MSD is interpreted as an error for the complete data field. The error type is formed from the characters "A", "C", "E", "F" (all corresponding to their hex code), "-", blank and the digits 0-9. The display may show an identical error code if displaying the variable, but the MSD digit on the display can contain only blank or the digits 0..9.

h) Decoding table for 2*16 entries (or 32 entries)

i) Subset functions

A slave may utilize either non, a single, several or all suggested special functions and their associated hex codes. A slave might utilize also a different number of hex code functions for different data fields. A slave could also use different display implementations for the various special functions and error displays but the suggested solution would simplify the operation of the system, since the master display will be identical to the slave display for the value associated with the appropriate data field.

a) Decoding table

b) Overrange

The overrange feature should be limited to a 10% overrange ($A in MSD). A further increment should lead directly to the MSD-error hex code $D, which should stop further increment and decrement and generate a suitable error code in the other digits

c) Underrange

The underrange feature should be limited to a 10% underrange ($F in MSD). A further decrement should lead directly to the MSD-error hex code $D, which should stop further increment and decrement and generate a suitable error code in the other digits.

d) Error codes

Error codes may contain only the letters "C" and "E", blank, "-" and the digits 0-9.

e) Compatiblity

At the master side this subset realisation is completely compatible and transparent to the full implementation.

The formerly described method for an alarm protocol (see diploma work of Andreas Steffens "Eigenschaften und Anwendungen des M-Bus") was based on time slices for each of the maximum 64 alarm devices. This alarm protocol has not been standardized.

We now suggest to return to standard alarm protocol which conforms to the standard IEC 870-2:

The master software polls the maximum 250 alarm devices by requesting time critical data (REQ_UD1 to adresses 1 .. 250). A slave can transmit either a single character acknowledgement E5h signalling no alarm or a RSP_UD with the CI-Field 71h to report an alarm state.

Fig. 11 Telegram for an Alarm-Respond

The alarm state is coded with data type D (boolean, in this case 8 bit). Set bits signal alarm bits or alarm codes. The meaning of these bits is manufacturer specific.

The timeout for time critical communication must be set to 11..33 bit periods to ensure a fast poll of all alarm devices. With a baudrate of 9600 Bd and all 250 slaves reporting an alarm just in time before a timeout occurs each slave will be polled in periods of maximum 5.5 seconds. This seems to be fast enough for alarms in building control systems and other applications. For faster alarm systems the number of alarm sensors could be limited to 63 (reducing the worst case overall signal delay to less than 1.5 sec or increase the transmission speed to 38400 Bd and achieve the same speed for up to 250 devices.

The functionality of the FCB- and FCV-Bit should be fully implemented in this alarm protocol to ensure that one-time alarms are safely transmitted to the master. If the slave has reported an one-time alarm and the next REQ_UD1 has a toggled FCB (with FCV=1) the slave will answer with an E5h signalling no alarm. Otherwise it will repeat the last alarm frame to avoid that the alarm message gets lost.

This alternate data structure has been defined in the first edition of this standard. Due to ist limited flexibility it is not recommend for new developments of meters or other slaves. It is described here for implementing universal master software for the transition period where devices using this protocol are still on the market or in use.

The slave with address 5 and identification number 12345678 responds with the following data (all values hex.):

68 13 13 68 header of RSP_UD telegram (L-Field = 13h = 19d)

08 05 73 C field = 08h (RSP_UD), address 5, CI field = 73h (fixed, LSByte first)

78 56 34 12 identification number = 12345678

0A transmission counter = 0Ah = 10d

00 status 00h: counters coded BCD, actual values, no errors

E9 7E Type&Unit: medium water, unit1 = 1l, unit2 = 1l (same, but historic)

01 00 00 00 counter 1 = 1l (actual value)

35 01 00 00 counter 2 = 135 l (historic value)

3C 16 checksum and stop sign

The master releases an enhanced application reset to all slaves. All telegrams of the user data type are requested.

The master can send data to a slave using a SND_UD with CI-Field 51h for mode 1 (or 55h for old mode 2-meters). Note that the data structure in such a write telegram has been changed in contrast to previous definitions by means of leaving out the fixed data header of 12 byte. The following figure shows the data structure for a write telegram. The order of the first three blocks in the following figure can be turned round, but the write only data record must be at the end of the telegram. All records are optional.

Fig. 15 Data Structure for Writing Data

· Primary Address Record:

DIF = 01h

VIF = 7Ah

Data = Address (1 byte binary)

· Enhanced Identification Record:

· Normal Data Records:

· Write-Only Data:

After receiving the SND_UD correctly without any error in data link layer the slave must answer with an acknowledgement (E5h). The slave decides whether to change variables or not after a data write from the master. In case of errors in executing parts of or whole write instructions the slave can decide whether to change no variables or single correct variables. The slave can report the this errors to the master in the next RSP_UD telegram using some of the methods which are described in chapter 6.6.

There are some methods for implementing write protect, for example allowing only one write after a hardware reset of the processor or enabling write if a protect disable jumper is set.

For default the slave transmits all his data with a RSP_UD. It could be useful for some applications to read only selected data records out of one or more devices. There are two ways to select data records:

The selection of the wanted data records can be performed with a SND_UD (CI-Field = 51h/55h) and data records containing the data field 1000b, which means "selection for readout request". The following VIF defines the selected data as listed in EN1434-3 and no data are transmitted. The answer data field is determined by the slave. The master can select several variables by sending more data blocks with this data field in the same telegram.

Special multiple values can be selected with the following methods:

· Any VIF:

· Global readout request:

· All Tariffs:

· All Storage Numbers:

· All Units:

· High Resolution Readout:

After the next REQ_UD2 the slave answers with the selected data in his own format, if the requested data are available. Otherwise the slave transmits his normal data and the master has to find out that the data are not the requested one. If there are more than one variables with the selected VIF, the device should send all these data records.

The master is able to perform a readout request with a specified data field by using the object action "add to readout list" (VIFE = E000 1100b) from VIFE-table for object actions (see chapter 7, table 176.5). The master transmits a SND_UD (CI-Field = 51h/55h) with a data record which consists of the desired DIF (data field), VIF and the VIFE = 0Ch / 8Ch. No data follows this VIFE and the slave should ignore the data field on reception. The slave should transmit this data record with the requested data field from now on, if he is capable of this. If the slave doesn´t support this data field (data coding), it can report a record error using one of the VIFE = E000 011x (data class not implemented or data size not implemented).

The master can release a reset of the application layer and especially a fallback to the slaves standard RSP_UD-Telegram by transmitting a SND_UD with the CI-Field $50.

Single data records can be deselected by transmitting a data record with DIF, VIF and the VIFE for the object action "Delete from Readout-List" (VIFE = E000 1101b).

If the selected data is supported by the slave but too long for one RSP_UD telegram (especially for readout of all historic values), the slave transmits an additional data record consisting only of the DIF=$1F, which means that more data records follow in the next respond telegram. In this case the master must readout the slave again until the respond telegram is only an $E5 (no data) or there is no DIF=$1F in the RSP_UD.

To avoid lost of data respond telegrams the slave should in this case support the Frame Count Bit (FCB). If the master wants to premature end such a multitelegram sequential readout of the selected data, it may send an application reset with CI=$50 instead of further REQ_UD2´s.

1. A slave with address 7 is to be configured to respond with the data records containing volume (VIF=13h: volume, unit 1l) and flow temperature (VIF=5Ah: flow temp.,

unit 0.1 °C).

68 07 07 68 | 53 07 51 | 08 13 08 5A | 28 16

2. A slave with address 1 is to be configured to respond with all storage numbers, all tariffs,

and all VIF´s from unit 0.

68 06 06 68 | 53 01 51 | C8 3F 7E | 2A 16

With these actions the master can alter the data of the slaves or configure the output data of the slaves (actions 12 and 13). The actions 0 to 6 alter the data of the slave by replacing the old data (action 0, equals to data write without VIFE) or do arithmetical or logical operations with the old and the transmitted data.

Note that this method of configuring the readout list (action 12 and 13) allows not only the adding but also the removal of elements in contrast to the method of using the DIF=1000b-type of readout request (described beforein chapter 6.4.3).

All these actions can be used for normal slaves and for intelligent master which are manipulated by a higher order master.

The functions "Add entry" and "Delete entry" are useful to tell an intelligent master to add e.g. a new data record like maximum or minimum values of any slave.

With the action "freeze data to storage #" the master can tell the slave to freeze the actual value corresponding to the transmitted VIF, unit, tariff and function to a certain storage number given in the DIF/DIFE´s. In this case the data field inside the VIF has got the value 0000b (no data). This action allows freeze of selected values or multiple freeze with VIF=$7E (all VIF). The date / time should also be freezed to the same storage number.

1) Set the 8 digit BCD-Counter (instantaneous, actual value, no tariff, unit 0) with VIF=06 (1kWh) of the slave with address 1 to 107 kWh.

68 0A 0A 68 | 53 01 51 | 0C 86 00 07 01 00 00 | 3F 16

2) Same as in example 1) but add 10 kWh to the old data.

68 0A 0A 68 | 53 01 51 | 0C 86 01 10 00 00 00 | 48 16

3) Add an entry with an 8 digit BCD-Counter (instantaneous, actual value, no tariff,

unit 0, 1kWh) with the start value of 511 kWh to the data records of the slave with address 5.

68 0A 0A 68 | 53 05 51 | 0C 86 08 11 05 00 00 | 59 16

4) Freeze actual flow temperature (0.1 °C: VIF = 5Ah) of the slave with address 1

into the storage number 1.

68 06 06 68 | 53 01 51 | 40 DA 0B | CA 16

Collisions between transmitting slaves can occur during slave search activities by the master. Very light collisions of (22..33) mA, which are equivalent to 2 or 3 transmitting slaves, are electrically undetectable by master and slave. New master hardware with double current detect can detect light collisons of (20..200) mA and then transmit a break (50 ms space) on the bus. The slave can detect medium collisions of (70..500) mA, if this is a collision between a mark and a space and if the slave supports this feature. Heavy collisions of (90..5000mA) will have the effect of a break down of the bus voltage (power fail in the slave) and possibly a shortcircuit in the master.

To avoid these consequences of (heavy) collisions new master have the feature of double current detect with break signaling and switching off the bus in overcurrent states. There are some means for the slaves to detect collisions and then stop transmitting:

A slave with implemented secondary addressing and with implemented FCB-administration must have an additional set of 0, 1 or 2 separate "Last Received FCB"-memory Bit(s) for all communication via the pseudo primary address 253 ($FD). If it can communicate also alternatively over some other primary address (exept the special addresses 254 and 255) an additional set of 0, 1 or 2 "Last received FCB"-memory bit(s) for each of these primary addresses is required. A valid selection telegram will not only set the internal selection bit but will also clear all 0, 1 or 2 internal "Last received FCB"-memory bit(s) associated with secondary addressing via the pseudo primary address 253 ($FD). The master will start the communication (REQ_UD2 or SND_UD) after any selection telegram (CI=$52 or $56) with the FCV-Bit set and the FCB-Bit set. If a slave has more than one alternative secondary identification, only a single set of 0, 1 or 2 "Last received FCB"-memory bit(s) for all secondary addresses is required.

The master must implement a separate pair of "Next FCB image"-Bits for pseudo primary address 253 ($FD) as for each other primary address. Although these "Next FCB image"-bits might be used for many slaves, no confusion exists, since for accessing another slave a selection telegram is required which will define the future FCB sequence both for slave and master.

Some optional or recommended features of the slaves will be described in this section.

The fabrication number is a serial number allocated during manufacture. It is part of the variable data block (DIF = $0C and VIF = $78) and coded with 8 BCD packed digits (4 Byte).

68 15 15 68 header of RSP_UD telegram (length 1Fh=31d bytes)

08 02 72 C field = 08 (RSP), address 2, CI field 72H (var.,LSByte first)

78 56 34 12 identification number = 12345678

24 40 01 07 manufacturer ID = 4024h (PAD in EN 61107), generation 1, water

13 00 00 00 TC = 13h = 19d, Status = 00h, Signature = 0000h

0C 78 04 03 02 01 fabrication number = 01020304

9D 16 checksum and stopsign

The use of this number is recommended if the identification number is changeable. In this case two or more slaves can get the same secondary adress and can not be uniquely selected. The fabrication number together with manufacturer, version and medium field build an unique number instaed. Suitable masters use this number for an enhanced selection method if two or more slaves have the same identification numbersecondary adress (see chapter 9.37.4).

The company Aquametro AG has simulated such a search to find the minimum, the average and the maximum number of selections as a function of the number of slaves. For the minimum number of attempts the optimum distribution of the identification numbers was chosen, for the maximum number the most unfavourable, and for the average number of attempts a random distribution. The following diagram shows the result of these calculations:

Fig. 16 Number of Selections with Wildcard Searching Procedure

The following program flow diagram shows the realization of the Wildcard searching procedure, whereby the search is made only with the identification number. The codes for manufacturer, version and medium are in general specified with wildcards, but can be changed by the user in order (for example) to locate all meters from a particular manufacturer. In order to avoid the categorisation by a factor of eight of the "For-To" loops for the eight positions, the array "Value" is defined with 8 byte numbers, which are intended to define the contents of the positions. The digit number of the identification number which is presently running is noted in the variable "Pos" of type byte.

Fig. 17 Flow Diagram for Slave Search with Wildcards

The routine begins at the first position, and implements the following actions for the value of this position from 0 to 9:

The next figure shows an example for secondary addresses in order from top to bottom, as they will be found by the master software:

Fig. 18 Secondary Addresses found with a Wildcard Search of Four Slaves

Search Process:

The identification number can be used as is a customer number and then can be changed by the operatormaster. Therefore it can be possible that two slaves have the same secondary adress. For this reason the selection telegram can be extended by a fabrication number to make sure that in any case all slaves are distinguishabledevide such slaves. This number is a serial number allocated during manufacture, coded with 8 BCD packed digits (4 Byte) like the identification number, and thus runs from 00000000 to 99999999.

The following figure shows the structure of an enhanced selection telegram released by the master.

After the field medium the new data is given in form of a structured datarecord with DIF=0Ch and VIF=78h. Parts of the fabrication number (Fab1..Fab4) can be occupied with wildcards (Fh).

If a fabrication number exists the slave should add this data to the variable data blocks in every RSP-UD telegram. If the fabrication number and enhanced selection is not implemented in a slave this device will not confirm the enhanced selection telegram and will be deselected.

Enhanced selection should be used only if the normal kind of selection is not successful.

[1] Färber, G. : Bussysteme, R.Oldenbourg Verlag München Wien, 1987

[2] Gabele, E., Kroll, M., Kreft, W. : Kommunikation in Rechnernetzen, Springer Verlag
Heidelberg, 1991

[3] Steffens, Andreas : Diplomarbeit " Der M-Bus - Eigenschaften und Anwendungen", University of Paderborn, Department of Physics, 1992

[4] Texas Instruments Deutschland GmbH : Data Sheet TSS 721, 1993

[5] Texas Instruments Deutschland GmbH : Seminar Material, M-Bus Workshop, 1992

[6] Ziegler, Horst : Seminar Material, M-Bus Workshop, 1992

[57] IEC 870-5-1 : Telecontrol Equipment and Systems, Part 5 Transmission Protocols, Section One - Transmission Frame Formats, 1990

[68] IEC 870-5-2 : Telecontrol Equipment and Systems, Part 5 Transmission Protocols, Section Two - Link Transmission Procedures, 1992

[9] EN1434-3: Heat Meters, Part 3 Data Exchange and Interface, 1997 §

[10] Aquametro AG Therwil : M-Bus Automatic Slave Recognition with Wildcard Algorithm, 1992

[11] Papenheim, Andreas: Diplomarbeit " Anwendungsbeispiele für den M-Bus", University of Paderborn, Department of Physics, 1993

[712] Texas Instruments Deutschland GmbH: Applications Report "Designing Applications for the Meter-Bus", 1994 (translation of reference [11])

[813] Ziegler, Horst; Froschermeier Günther: "M-Bus: Die Meßbus-Alternative", Elektronik 16/1993

Note that a WWW-server operated by the m-bus-user group at "http://www.m-bus.com" provides a forum for up to date information on the M-bus.