M-BUS

Nápověda k protokolu M-BUS

Referenční přehled rámců, polí a datových struktur v pořadí, ve kterém se čtou v telegramu M-BUS.

M-BUS

Telegrams

During manual diagnostics, the first step is to identify the message type. The first byte usually distinguishes a short frame, long frame, and the single-byte E5 acknowledge.

Single character Short frame Control frame Long frame
E5h Start 10h Start 68h Start 68h
C field L field = 3 L field
A field L field = 3 L field
checksum Start 68h Start 68h
Stop 16h C field C field
A field A field
CI field CI field
checksum User data
Stop 16h (0-252 bytes)
checksum
Stop 16h

Single Character

The single E5 byte means acknowledgement without additional data. In diagnostics, it is important to distinguish it from a response that actually contains measured values.

Property Value and Meaning
Value E5h
Length 1 Byte
Typical direction Slave → Master as acknowledgement of a received command.
RX E5 Single-byte acknowledgement without a data payload.

Short Frame

A short frame has a fixed length and is used for simple control messages. A typical form is 10 C A CS 16, where C is the control field, A is the address, CS is the checksum, and 16 terminates the frame.

Start C A CS Stop
10h control code address (C+A)mod 256 16h
Element Decode Check
10h The first byte must be the short-frame start byte. Any other value means another message type or a receive error.
C Defines the procedure, for example SND_NKE, REQ_UD1, or REQ_UD2. Bit meaning is evaluated according to the master/slave direction.
A Must match the target primary address, or a broadcast address according to the request purpose.
CS First only bytes C and A are added, then the lower 8 bits of the result are taken, meaning modulo 256. The start and stop bytes are not included.
TX 10 5B 01 5C 16 Data request to a device with primary address 01.

Control Frame

A control frame uses the 68h start byte but has a fixed length L = 3. It carries only the C, A, and CI fields, meaning control information without user data.

In diagnostics it is used for commands that configure or select a device and do not need to carry measured values.

Start L L Start C A CI CS Stop
68h 03h 03h 68h control code address application code (C+A+CI)mod 256 16h
Use Technical Meaning
Device selection The master can use CI and related rules to prepare a slave for further communication without sending measured data in this frame.
Application command without DATA The frame carries the information in the CI field. Once the command needs parameters or application data, a long frame is used.
Validation Both L bytes must be 03h, the second start must be 68h, and the checksum is calculated only from C, A, and CI as modulo 256.
TX 68 03 03 68 53 01 51 A5 16 Control frame with fixed length L = 3.

Long Frame

A long frame carries a data payload. A typical form is 68 L L 68 C A CI DATA CS 16. The L pair defines the length from C through the end of data, and CI identifies the application data type.

Start L L Start C A CI DATA CS Stop
68h L L 68h control address data type 0-252 Byte (C+A+CI+ΣDATA)mod 256 16h
Validation Step Rule
Start and length The first and fourth bytes must be 68h and both L bytes must have the same value.
L range L includes C, A, CI, and DATA. Therefore a minimum long frame without DATA has L = 3, and each DATA byte increases L by 1.
Checksum CS is calculated as modulo 256 from the sum of bytes C, A, CI, and all DATA bytes. Start, L, CS itself, and stop are not included.
DATA interpretation DATA must not be read without CI. CI determines whether the payload is variable data, fixed data, error report, alarm, or another application meaning.
RX 68 15 15 68 08 01 72 78 56 34 12 24 40 01 07 02 00 00 00 04 00 10 27 00 00 38 16 Device response with a variable data header and one data record.

Data Decoding

Decoding proceeds from frame to data: first verify start, length, and checksum, then the C control field, A address, CI field, and finally DIF/VIF data records.

Part Meaning
C Direction and type of request or response.
A Primary address of the device on the bus.
CI Application data type, for example a variable response with data records.
DIF/VIF Encoding of value, function, meaning, and unit of a data record.

L Field

The L field defines the length of the variable part of a long or control frame. In a long frame, two identical L bytes follow the first 68h start byte, followed by the second 68h start byte.

The L value is counted from the C field through the last DATA byte inclusive. It does not include the 68h start bytes, the L fields themselves, checksum CS, or the 16h stop byte. If the two L values differ, the frame is invalid.

Frame Form Meaning of L
Control frame 68 03 03 68 C A CI CS 16 Fixed length 3 because the frame contains only C, A, and CI.
Long frame 68 L L 68 C A CI DATA CS 16 Variable length of the C, A, CI, and DATA area.
Example L Calculation
68 03 03 68 53 01 51 A5 16 L = 3 because only bytes 53h, 01h, and 51h are counted.
68 13 13 68 08 05 73 ... CS 16 L = 13h, meaning 19 bytes from C field 08h through the last payload byte.

During manual decoding, the L field is a good first error filter. If the length is wrong, interpreting DIF/VIF is not useful because a data offset usually breaks the rest of the telegram.

C Field

The C field, also called the Control Field or Function Field, contains the frame control parameters. It defines the data direction and, through the lower function bits, the actual purpose of the message.

In diagnostics, the C field quickly shows whether the frame is an initialization, a write to the device, a data request, or a slave response. In a short frame it follows the 10h start byte; in control and long frames it follows the second 68h start byte. The C field value is included in the checksum.

Direction 7 6 5 4 3 2 1 0
Master → Slave 0 1 FCB FCV F3 F2 F1 F0
Slave → Master 0 0 ACD DFC F3 F2 F1 F0
Bits Name Applies To Communication Meaning
7-6 direction pattern both directions Value 01b indicates master → slave, value 00b indicates slave → master.
5 FCB / ACD by direction For the master it is the frame count bit; for the slave it is a request to transfer priority Class 1 data.
4 FCV / DFC by direction For the master it validates FCB; for the slave it is data flow control and indicates that the device is not ready to receive more data.
3-0 F3-F0 both directions Function code of the procedure, for example initialization, data request, or data response.

In the master → slave direction, the FCB bit alternates between 0 and 1 during error-free communication. If the master does not receive a response to the previous frame, it repeats the same frame with the same FCB and the slave should return the same response again. The FCV bit indicates whether FCB is valid; when FCV = 0, FCB is ignored.

In the slave → master direction, bits 5 and 4 have different meanings. ACD = 1 signals that the slave needs to send priority Class 1 data. DFC = 1 is data flow control: the slave is not ready to accept more data.

Bits F0 to F3 encode the message function itself. The M-BUS data link layer uses two basic procedures: send with confirmation, SND/CON, and request with response, REQ/RSP.

Name C field bin. C field hex. Frame Description
SND_NKE 0100 0000 40 short Slave station initialization.
SND_UD 01F1 0011 53/73 long/control Sending data from the master station to the slave station.
REQ_UD2 01F1 1011 5B/7B short Request for regular Class 2 data from the slave station.
REQ_UD1 01F1 1010 5A/7A short Request for priority Class 1 data from the slave station.
RSP_UD 00AD 1000 08/18/28/38 long/control Sending data from the slave station to the master station after a request.

A Field

The A field is the device address on the M-BUS. The master uses it to identify which meter or converter the telegram is addressed to, and the slave returns the same address in its response.

During service diagnostics, the A field is the first place to check whether the configured primary address matches the device response. If the address differs, another device may be responding or the program may use the wrong address.

HEX DEC Meaning Response
00h 0 Default or unassigned primary device address. A response is returned if the device uses address 0.
01h-FAh 1-250 Common primary device addresses in the range 1 to 250. The device with the matching primary address responds.
FDh 253 Broadcast for secondary addressing. The specific device is selected by application data, not directly by the A field. A response is returned by the device selected by secondary address.
FEh 254 Test broadcast. All devices may respond, so it is mainly used when there is only one device on the bus. Responses may come from all devices; collisions are likely with multiple devices.
FFh 255 Broadcast address for a message to all devices without a normal individual response. No response is returned.
Addressing Mode What to Check Service Risk
Primary address 0-250 Match of the A field in request and response, address configuration in the device, and duplicate-address collision. Two devices with the same primary address can answer simultaneously and corrupt the response.
Secondary addressing through FDh The device selection is not in the A field itself, but in the application data of the selection telegram. Without correct secondary-address selection, no device may answer even when it is physically connected.
Broadcast FEh and FFh Use FEh mainly for testing a single device; FFh is a message to all devices without a normal individual response. On a bus with multiple devices, FEh can cause response collisions.
TX 10 5B 01 5C 16 The A field is 01h, so the telegram targets the device with primary address 1.

CI Field

The CI field, Control Information, identifies the type of application data in the telegram and the sequence used for the application payload.

For multibyte records, EN1434-3 defines two possible byte orders. The selector is bit 2 of the CI field, counted from bit 0, so the value is 4. This bit is called the M bit or Mode bit.

Mode M bit Byte order Note
Mode 1 0 The least significant byte is transmitted first. Recommended mode for new applications.
Mode 2 1 The most significant byte is transmitted first. Kept for compatibility.
What CI Determines Decoder Consequence
Application payload type The same DATA bytes may mean something different depending on CI. After C and A, the decoder must therefore evaluate CI first and only then choose the next parser.
Multibyte value order The mode bit selects little-endian or big-endian order in application records. Normal new implementations are expected to use Mode 1.
Direction of code usage Some CI codes are used by the master for write or selection commands, while others are used by the slave in RSP_UD responses. CI must therefore always be read together with the C field.

Codes Used by the Master

Mode 1 Mode 2 Use Defined in
51h55hData send.EN1434-3
52h56hSelection of slaves.Usergroup July 1993
50hApplication reset.Usergroup March 1994
54hSynchronize action.suggestion
B8hSet baudrate to 300 baud.Usergroup July 1993
B9hSet baudrate to 600 baud.Usergroup July 1993
BAhSet baudrate to 1200 baud.Usergroup July 1993
BBhSet baudrate to 2400 baud.Usergroup July 1993
BChSet baudrate to 4800 baud.Usergroup July 1993
BDhSet baudrate to 9600 baud.Usergroup July 1993
BEhSet baudrate to 19200 baud.suggestion
BFhSet baudrate to 38400 baud.suggestion
B1hRequest readout of the complete RAM content.Techem suggestion
B2hSend user data, non-standardized RAM write.Techem suggestion
B3hInitialize test calibration mode.Usergroup July 1993
B4hEEPROM read.Techem suggestion
B6hStart software test.Techem suggestion
90h-97hCodes used for hashing.obsolete, no longer recommended

Application Reset CI = 50h

CI code 50h lets the master reset the application layer in a slave. After receiving it, the slave decides which parameters to change, for example the default data output. This reset sent as SND_UD with CI = 50h is the application-layer counterpart of the SND_NKE data-link reset.

Optional parameters may follow CI = 50h. The first parameter is an 8-bit application reset subcode: the upper four bits select the telegram type or application, and the lower four bits select the subtelegram number. A zero in the lower four bits requests all subtelegrams.

A slave with only one telegram type may ignore the application reset and the added parameters, but it must acknowledge the command with E5.

Upper 4 bits Description Example
0000bAll
0001bUser dataconsumption
0010bSimple billingactual and fixed-date values including dates
0011bEnhanced billinghistoric values
0100bMulti tariff billing
0101bInstantaneous valuesregulation
0110bLoad management valuesmanagement
0111bReserved
1000bInstallation and startupbus address, fixed dates
1001bTestinghigh resolution values
1010bCalibration
1011bManufacturing
1100bDevelopment
1101bSelftest
1110bReserved
1111bReserved
TX 68 04 04 68 53 FE 50 10 B1 16 The master sends an enhanced application reset to all slaves and requests all user-data telegrams.
RX E5 The slave acknowledges the reset with a single E5 byte.

Synchronize Action CI = 54h

CI 54h is intended for synchronization functions in slaves and masters, for example clock synchronization. The other codes listed here are used for baudrate changes, data sending, and slave selection.

Codes Used by the Slave

CI M=0 CI M=1 Use Defined in
70hReport of general application errors.Usergroup March 1994
71hReport of alarm status.Usergroup March 1994
72h76hVariable data response.EN1434-3
73h77hFixed data response.EN1434-3

In practice these codes are interpreted by the response category: fixed data, variable data, general application error, or alarm status.

Fixed Data Structure CI = 73h/77h

The fixed data structure is used in the slave → master direction in a long RSP_UD frame. CI values 73h and 77h tell the decoder that the CI field is not followed by variable DIF/VIF records, but by a fixed block with identification, status, and two counters.

Because the fixed structure can carry only two counters with predefined length and is less descriptive than the variable structure, it is not suitable for new extensible applications. Existing meters still require correct recognition and decoding.

Ident. no. Access No. Status Medium/Units Counter 1 Counter 2
4 Byte 1 Byte 1 Byte 2 Byte 4 Byte 4 Byte
Field Coding Meaning
Identification number 8 packed BCD digits in 4 bytes Manufacturing or serial number in the range 00000000 to 99999999.
Access No. unsigned binary Access counter incremented after each RSP_UD response, helping distinguish new data from repeats.
Status bit flags Defines counter coding, fixed-date values, and device errors.
Medium/Units LSByte first Carries the common measured medium and the units of both counters. The lower six bits of each byte define the unit of the corresponding counter, while the upper bits of both bytes together encode the medium.
Counters 1 and 2 4 Byte Values are encoded as BCD or signed binary according to bit 0 in the Status field.
Status Bit Meaning When 1 Meaning When 0
0Counters are encoded as signed binary.Counters are encoded as BCD.
1Counters are stored at a fixed date.Counters are actual values.
2Power low.Power is not reported low.
3Permanent error.No permanent error.
4Temporary error.No temporary error.
5-7Manufacturer-specific meaning.Manufacturer-specific meaning.
RX 68 13 13 68 08 05 73 78 56 34 12 0A 00 E9 7E 01 00 00 00 35 01 00 00 3C 16 RSP_UD with fixed data structure: address 5, CI 73h, identification number 12345678, two counters.

Variable Data Structure

CI codes 72h and 76h identify a variable data structure in a long RSP_UD frame. After the C, A, and CI fields, the application part starts with a fixed data header and continues with a variable number of data records.

Fixed header 12 Byte Device identification, manufacturer, version, medium, access number, status, and signature.
Data records DIB + VIB + DATA Repeated standard records with their own length, function, unit, and value.
MDH 1 Byte Marks the transition to a manufacturer-specific part when present.
Manufacturer data variable length Area that cannot be reliably interpreted without documentation from the specific manufacturer.
Part Length Meaning
Fixed data header 12 Byte Device identification and status information valid for the whole response.
Variable data blocks variable number Individual data records in the form DIB, VIB, and data. Each record carries its own length, function, unit, and meaning.
MDH 1 Byte The Manufacturer Data Header separates the standard records from the manufacturer-specific part.
Manufacturer-specific data variable number Free area defined by the device manufacturer. Without manufacturer documentation it cannot be decoded generically like standard data records.

Fixed Data Header of a Variable Response

The first twelve bytes of user data form a fixed-length block with a fixed field order. The variable data records follow only after this header.

Ident. no. Manufacturer Version Medium Access No. Status Signature
4 Byte 2 Byte 1 Byte 1 Byte 1 Byte 1 Byte 2 Byte
Field Length Meaning
Identification number 4 Byte In the variable data structure this is a customer number encoded as eight packed BCD digits, so the range is 00000000 to 99999999. It may be preset during production, but it may also be changeable later; if a permanent manufacturing number is needed, it is sent as a separate record, for example DIF = 0Ch and VIF = 78h.
Manufacturer 2 Byte A two-byte unsigned binary value calculated from the three-letter EN 61107 manufacturer ID. Uppercase letters are used and the value is built from the alphabet positions of the letters.
ID = ([ASCII(1) - 64] * 32 * 32)
+ ([ASCII(2) - 64] * 32)
+ [ASCII(3) - 64]
Version 1 Byte Specifies the meter generation or version. The exact meaning depends on the device manufacturer.
Medium 1 Byte Measured medium type. Unlike the fixed data structure, the medium in a variable response is encoded by a full byte.
Access No. 1 Byte The access number is an unsigned binary response counter. It is typically incremented after each RSP_UD response and helps distinguish a new response from a repeated one.
Status 1 Byte Status carries the device status bits. In a variable response, the two lowest bits are used to indicate application errors; the remaining bits keep the same meaning as the status flags known from the fixed data structure.
Signature 2 Byte This field is reserved for future encryption applications. When it is not used, it is normally set to 00 00h.
Status bit Meaning in a Variable Response
0-1Application error or state according to the device specification and related M-BUS rules.
2Low device power.
3Permanent device error.
4Temporary device error.
5-7Manufacturer-specific flags. Without device documentation they should not be interpreted as standard errors.
Header Bytes Field Decoded Meaning
78 56 34 12Identification numberPacked BCD number 12345678.
24 40ManufacturerTwo-byte EN 61107 manufacturer code transmitted in the header.
01VersionMeter version or generation according to the manufacturer.
07MediumMeasured medium code.
02Access No.Second response sequence number in the device cycle.
00StatusNo standard error signaled by the status flags.
00 00SignatureSignature is not used.

DATA Records

After the fixed 12-byte header, one or more data records follow. Each record is described by its own DIB and VIB blocks; the actual value bytes come only after them.

DIB DIF + DIFE... Describes value format, value function, storage number, tariff, and optional further extension.
VIB VIF + VIFE... Describes quantity, unit, scale, and additional meaning of the value.
DATA 0 to n bytes Contains the actual value. Byte count and coding come from the lower DIF nibble.
DIB VIB DATA
DIF + DIFE... VIF + VIFE... value according to DIF
Record part Length Meaning
DIF 1 Byte The Data Information Field defines the value length and coding, the value function, and whether DIFE follows.
DIFE 0 or more bytes Extends the DIB mainly with additional storage-number and tariff bits. If the extension bit is set in the previous DIF or DIFE, another DIFE follows.
VIF 1 Byte The Value Information Field defines the physical quantity, unit, and multiplier of the value. Its extension bit indicates whether VIFE follows.
VIFE 0 or more bytes Extends the VIB with additional unit or value-meaning information. Multiple VIFE bytes may follow according to the extension bits.
DATA according to DIF The actual value bytes. The byte count and coding are defined by the lower nibble of DIF. The byte order of a multibyte value follows the CI-field mode; new applications use Mode 1, least significant byte first.

DIB and VIB in Detail

A data record is not read by a fixed total record length, but step by step. First the DIB is assembled, then the VIB, and only then the actual DATA value is read according to the lower DIF bits.

Abbreviation Full name Contents
DIB Data Information Block Data information block. It consists of one DIF and optional DIFE bytes.
DIF Data Information Field First byte of the DIB. It defines DATA coding and length, the value function, the lowest storage-number bit, and whether DIFE follows.
DIFE Data Information Field Extension Extension of DIF. It adds more storage-number bits, tariff, subunit, and optionally points to another DIFE.
VIB Value Information Block Value information block. It consists of one VIF and optional VIFE bytes.
VIF Value Information Field First byte of the VIB. It defines the quantity, unit, value scale, and whether VIFE follows.
VIFE Value Information Field Extension Extension of VIF. It refines the unit or meaning of the value and may continue with another VIFE.

Data Record Read Order

Step Part Read Rule
1DIFRead the first record byte. Special values 0Fh, 1Fh, and 2Fh are handled before normal decoding.
2DIFE...If bit 7 is set in DIF, DIFE follows. If that DIFE also has bit 7 set, another DIFE is read.
3VIFAfter the DIB is complete, VIF is read to determine the unit and scale of the value.
4VIFE...If bit 7 is set in VIF, VIFE follows. Chaining continues until the last VIFE has bit 7 cleared.
5DATAFinally, the DATA byte count is read according to the lower four DIF bits.

DIF Bit Layout

7 6 5 4 3 2 1 0
DIFE Storage 0 Function Data field
Bits Name Meaning
7extension bitValue 1 means that at least one DIFE follows DIF.
6storage number bit 0Lowest storage-number bit, the first distinction between current and historical values.
5-4value functionDefines whether the value is instantaneous, maximum, minimum, or an error-state value.
3-0data fieldDefines the number of DATA bytes and their coding.

DIFE Bit Layout

7 6 5 4 3 2 1 0
DIFE Subunit Tariff Storage
Bits Name Meaning
7extension bitValue 1 means that another DIFE follows.
6subunitDistinguishes a subunit or meter channel when the device uses it.
5-4tariffTariff bits for multi-tariff values.
3-0storage numberAdditional storage-number bits. Each additional DIFE adds another four bits.
Result from DIB Composition Use During Decoding
Storage number DIF bit 6 + DIFE bity 3-0... Distinguishes current values, historical values, and other stored value sets.
Value function DIF bity 5-4 Selects instantaneous, maximum, minimum, or error-state value.
Tariff DIFE bity 5-4... Distinguishes tariff registers in multi-tariff meters.
Subunit DIFE bit 6... Distinguishes channel, meter part, or subunit when the device uses it.

VIF and VIFE Bit Layout

Field 7 6 5 4 3 2 1 0
VIF VIFE Quantity, unit, and scale code
VIFE VIFE Additional VIF code
Field Bits Meaning
VIF7Extension bit. Value 1 means that VIFE follows VIF.
VIF6-0Code of the quantity, unit, and value scale, for example energy, volume, flow, temperature, or date.
VIFE7Extension bit. Value 1 means that another VIFE follows.
VIFE6-0Additional code for VIF. It refines the unit, scale, time meaning, or manufacturer-specific value meaning.

Primary VIF - Main Unit Groups

VIF bits 6-0 Quantity Unit base Scale
00h-07hEnergyWhby code in range
08h-0FhEnergyJby code in range
10h-17hVolumem3by code in range
18h-1FhMasskgby code in range
20h-23hOn times / min / h / dunit selected by code
24h-27hOperating times / min / h / dunit selected by code
28h-2FhPowerWby code in range
30h-37hPowerJ/hby code in range
38h-3FhVolume flowm3/hby code in range
40h-47hVolume flowm3/minby code in range
48h-4FhVolume flowm3/sby code in range
50h-57hMass flowkg/hby code in range
58h-5BhFlow temperature°Cby code in range
5Ch-5FhReturn temperature°Cby code in range
60h-63hTemperature differenceKby code in range
64h-67hExternal temperature°Cby code in range
68h-6BhPressurebarby code in range
6ChDatespecial date coding
6DhDate and timespecial date-time coding
6EhHCA unitswithout physical unit
70h-73hAveraging durations / min / h / dunit selected by code
74h-77hActuality durations / min / h / dunit selected by code
78hFabrication numberidentification value
7AhBus addressaddress in data

Special DIF Values

DIF Meaning
0FhStart of manufacturer-specific data; the rest of the telegram is no longer read as standard DIF/VIF records.
1FhMarker that more records follow, typically in another telegram or block.
2FhFill byte. It is skipped during decoding and does not represent a data record.

DIF and DATA Length

DIF data field DATA length Coding
0000b / 0h0 Byteno data
0001b / 1h1 Byte8-bit integer
0010b / 2h2 Byte16-bit integer
0011b / 3h3 Byte24-bit integer
0100b / 4h4 Byte32-bit integer
0101b / 5h4 Byte32-bit real
0110b / 6h6 Byte48-bit integer
0111b / 7h8 Byte64-bit integer
1000b / 8h0 Byteselection for readout
1001b / 9h1 Byte2 digit BCD
1010b / Ah2 Byte4 digit BCD
1011b / Bh3 Byte6 digit BCD
1100b / Ch4 Byte8 digit BCD
1101b / Dhvariablevariable length
1110b / Eh6 Byte12 digit BCD
1111b / Fhspecialspecial functions

Value Function in DIF

Bits 5-4 Function Meaning
00binstantaneous valuenormal current measured value
01bmaximum valuestored maximum for the given period or storage
10bminimum valuestored minimum for the given period or storage
11bvalue during error statevalue valid or stored during an error state