Home

MBUS - Radiocrafts AS

1. OxF8 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF Grey Reserved do not change Blue Reserved for Module part number and version information do not change Typical values shown the actual content of memory location 60d 83d depends on part number and version number 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 41 of 43 Radiocrafts Embedded Wireless Solutions M B U S Appendix ASCII Table 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 42 of 43 Radiocrafts Embedded Wireless Solutions M B U S Document Revision History First release Detailed UART interface and Encryption example included Minor changes and corrections Timing and figure 3 corrections Auto sleep included Minor corrections in text Added MBUS3 Clarified order of address bytes for binding MBUS3 updates before official release MBUS2 new features for FW 2 20 Auto sleep functionality update for slaves 8 Byte serial number reservations in configuration memory 1 byte frequency tolerance calibration value in configuration memory Changed terminology from RC1180 MBUSx to MBUSx Included quick start chapter and removed it from data sheet 2 20 RSSI reading included and removed it from data sheet rev 2 20 Optional custom specific version chapter included for MBUS2 SLEEP_MODE TIMEOUT and LED CONTROL update for MBUS2 MBUS3 new features for FW 3 09 8 Byte serial n
2. NO 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 9 of 43 Radiocrafts e LL MBUS UART Timing Information A UART byte consist of one start bit 8 data bits and one stop bit In configuration mode a command to prompt reply will looks like this Command Prompt nmi k T_UART_BYTE T_Command 2Prompt_WAIT Figure 5 UART Command and prompt The command to prompt wait time T_Command2Prompt_WAIT is different from command to command and values are shown in the timing table for each MBUS feature set The IDLE state is the normal state where the module both searches for preamble on the RF and wait for a character to be received on the UART RXD is the state when receiving characters from the host filling up the internal buffer TX state is when the data is transmitted on the air RX state is when data is received from the air after preamble detection TXD is the state where the received data is sent to the host on the UART CONFIG is the configuration mode the state entered by sending 00h or asserting the CONFIG pin and is entered during parameter configuration while MEMORY CONFIG is the sub state entered by the M command where the non volatile configuration memory is being programmed Note the limitation on maximum number of write cycles using the M command see Electrical Specifications 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 10 of 43 Radiocrafts Preamble detecte
3. 0x20 0x27 0x07 0x01 0x01 0x00 0x00 0x00 0x00 0x04 0x28 0x2F OxFF 0x08 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x37 0x05 0x08 0x00 0x01 0x05 0x00 0x00 0x01 0x38 0x3F 0x2B 0x00 0x01 0x44 0x00 0x52 0x43 0x31 0x40 0x47 0x31 0x38 0x30 0x2D 0x4D 0x42 0x55 0x53 0x48 0x4F Ox2C 0x31 0x2E 0x30 0x30 0x2C 0x31 Ox2E Ox50 0x57 0x31 0x35 0x00 OxFF OxFF OxFF OxFF OxFF 0x58 0x5F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x60 0x67 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x68 0x6F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF Ox70 Ox77 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x78 0x7F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x00 0x07 0x01 0x05 0x03 0x02 0x00 0x00 0x64 0x00 0x08 0x0F 0x00 0x00 0x00 0xD3 0x91 OxDA 0x80 0x80 Ox10 0x17 Ox7C 0x00 0x01 0x01 0x00 0x00 0x00 0x00 0x18 0x1F 0x00 0x0C OxAE 0x12 0x34 0x56 0x78 0x01 0x20 0x27 0x07 0x01 0x01 0x00 0x00 0x00 0x00 0x04 0x28 0x2F OxFF 0x08 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x37 0x05 0x08 0x00 0x01 0x05 0x00 0x00 0x01 0x38 0x3F 0x2B 0x00 0x00 0x06 0x0B 0x02 0x00 0x00 0x40 0x47 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF Ox48 Ox4F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x50 0x57 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x58 0x5F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x60 0x67 0x00 0x52 0x43 0x31 0x31 0x38 0x30 0x2D 0x68 0x6F Ox4D 0x42 0x55 0x53
4. byte indicating If a valid packet has been Strength the signal strength of a received when in RSSI detected signal or a valid configuration mode it will packet return the RSSI of the last received packet Destination T 0x54 8 bytes Data is stored in volatile module MAN_ID2 Second memory only address manufacturer code MAN_ID1 First manufacturer code ID4 ID3 ID2 ID1 VER Version DEV Device Type Exit command X 0x58 none Exit to normal operation mode All changes of parameters take effect Sleep mode Z 5 none Exit sleep mode by sending 0xFF on UART RXD pin Test mode 0 0 0x30 List all configuration memory parameters Test mode 1 1 0x31 none TX carrier Test mode 2 2 0x32 none TX modulated signal PN9 sequence Test mode 3 3 0x33 none TX Off RX mode 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 14 of 43 Radiocrafts MBUS Note ASCII characters are written as X hexadecimal numbers are written like 0x00 and decimal numbers are written like 10 throughout the text A table of ASCII characters and their respective hex and decimal values are found in the Appendix Any invalid command will be ignored and the gt prompt will be re sent If Test mode 1 or 2 is used it is important to enter Test mode 3 before exiting the configuration mode in order to ensure proper operation in nor
5. The module supports AES 128 encryption When a slave is registered into the masters address register the master host should request the encryption key from the utility data base The new key is specific for each slave and related to the slave equipment ID or unique address Currently OMS does not specify how to distribute new keys over the air to the slave The master host should send the new plain key to the master module using the K command followed by the register location number and the 16 bytes the new key The register location number must correspond to the address register location for that slave The ENCRYPT_FLAG and DECRYPT_FLAG parameters are used to set the flags to enable disable the encryption when transmitting and receiving messages For a message to be encrypted the encryption flag for the particular slave must be set and the Cl field and Signature field sent to the module must be according to the standard for encryption to take place The message to be encrypted must have stuffing bytes 2F if required to get a full 16 byte encryption block Only Cl fields 5 0x5B 0x60 0x61 0x64 0x65 0x6C Ox6D 0x72 Ox7C 0x7D Ox7E Ox7F 0x80 0x8A and 0x8B allows encryption The Signature field must set encryption mode 0x04 or 0x05 according to OMS When using Signature field 0x05 the application must add the two encryption verification bytes Ox2F after the header The Initialization Vector for the
6. 0x05 19200 0x06 28800 0x07 38400 0x08 57600 0x09 76800 Ox0A 115200 0x0B 230400 0x05 5 BE CAREFUL IF CHANGING AS HOST MAY LOOSE CONTACT WITH MODULE Does not take effect until module is re booted reset UART FLOW CTRL UART flow control 0x35 0 None 1 CTS only 3 CTS RTS 4 RXTX RS485 0x00 0 DATA_INTERFACE Data interface 0x36 0x00 MBUS packet with ID and address 0x01 Application data only 0x02 Reserved 0x03 Application data only with ack 00 3Eh 0x04 Add start stop byte 0x08 Add CRC Ox0C Add start stop byte and CRC 0x00 0 Sets receiver data format First byte is always packet length except when using start byte FREQ_CAL 0x39 Different for each module Found in factory and used by the module to minimise the total frequency tolerance For firmware upgrade read back the value and write it back after the upgrade LED_CONTROL Ox3A 0 Disabled 1 RX TX indicator 2 UART RF IDLE indicator 0x00 0 Use to enable LEDO LED1 for RX TX packet indication or UART RF IDLE mode indicator CONTROL FIELD C field Ox3B 0x00 0xFF 0 255 0x06 6 Use F command to change value in volatile 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 37 of 43 Radiocrafts MBUS memory only RX TIMEOUT 0x3C 0x00 0xFF 0x06 6 Delay before Sl
7. 0x2C 0x31 0x2E 0x30 0x70 0x77 0x30 0x2C 0x32 0x2E 0x30 0x30 0x00 OxFF 0x78 0x7F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x80 0x87 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x88 0x8F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0 90 0 97 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x98 0x9F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 OxAO OxA7 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 OxA8 0xAF 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 OxBO OxB7 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xB8 0xBF 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 OxC0 0xC7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxC8 0xCF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxDO 0xD7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxD8 OxDF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxEO OxE7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxE8 0xEF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFO OxF7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxF8 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 40 of 43 Radiocrafts e MBUS 0x00 0x07 0x01 0x05 0x03 0x01 0x00 0x00 0x64 0x00 0x08 0x0F 0x05 0x3C 0x00 0xD3 0x91 OxDA 0x80 0x80 Ox10 0x17 Ox7C 0x00 0x01 0x01 0x00 0x00 0x17 0x00 0x18 0x1F 0x00 0x0C OxAE 0x12 0x34 0x56 0x78 0x01 0x20 0x27 Ox07 0x01 0x01 0x00 0x00 0x00 0x00 0x04 0x28 0x2F
8. 2 0x32 none TX modulated signal PN9 sequence Test mode 3 9 0x33 TX off RX mode Test mode 4 4 0x34 none IDLE TX off RX off Note ASCII characters are written as X hexadecimal numbers are written like 0x00 and decimal numbers are written like 10 throughout the text A table of ASCII characters and their respective hex and decimal values are found in the Appendix Any invalid command will be ignored and the gt prompt will be re sent If Test mode 1 or 2 is used it is important to enter Test mode 3 before exiting the configuration mode X in order to ensure proper operation in normal mode Example To select RF channel 3 send the follow sequence after asserting the CONFIG line and the gt prompt is received Command Hex Response Comment Note Enter 0x00 gt Or assert CONFIG pin De assert CONFIG after gt prompt C 0x43 gt 3 0x03 gt Wait for gt prompt A new command could be issued here X 0x58 none Module returns to IDLE state Note that the CONFIG line must be de asserted after the first gt prompt was received but before the X command MBUS3 Configuration Memory 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 35 of 43 Radiocrafts MBUS The table below shows the complete list of configurable parameters stored in non volatile memory These values can be changed using the M command All addresses and arguments
9. Bit in the C field depending on the last transmitted FCB bit as stored in the Flag Register The FCB bit is automatically alternated A reply is only sent if the DFC bit in the MAILBOX configuration parameter is cleared The Status byte will automatically be set to the incoming packet RSSI value and the Access Number will be set automatically depending on the incoming message Before a transmission the Access Number can be set to a new value using the N command reply to SND IR and ACC DMD use the incoming Access Number for the reply If several flags are set the most significant bit flag has the highest priority The Mailbox has priority above the standard messages Mailbox messages will only be sent in reply to certain incoming message types as shown in the table above in red However the module can also be configured the AMMB parameter to use the mailbox for any incoming message The MAILBOX configuration parameter is used to set auto clearing of flags for standard messages and the mailbox There are up to 15 mailboxes that can be used to store pre cooked messages Each mailbox is 64 bytes except mailbox number 15 which is 128 bytes Mailboxes can be combined to support messages up to 255 bytes less the header When using more than 64 bytes for one message the following mailbox cannot be used That is if four mailboxes of 255 bytes are to be used they should be address as number 1 5 9 and 13 2010 Radiocrafts AS
10. I 5 5 Slave RXD UART SlaveMODE SEEP_ DiE Tx RX IDLE SLEEP T RX IDLE SLEEP Slave 2nd RX only if ACK received from Master 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 18 of 43 Radiocrafts e MBUS MBUS2 Installation and Binding The module Master can be set in Installation Mode using the I command When the module is in Installation Mode it will accept all Access Demand Install messages C field is 46h in T1 and 06h T2 Slaves be bound to Master registering their addresses the Address Register This is done by using the B Bind command followed by a register number 1 8 and an 8 bytes slave address Thus a maximum of 8 meters can be bound to one Master for the MBUS2 feature set meeting NTA 8130 request for minimum 4 meters Note the host must know which registers are used and which are free at any time MBUS2 Encryption The module supports AES 128 encryption When a slave is registered into the masters address register the master host should request a new encryption key from the utility data base The new key is specific for each slave and related to the slave equipment ID or unique address The new key should be provided in two versions plain and encrypted using the slave s default key That is the utility needs to keep a register with default keys linked to each meter The master host should send the new encrypted key to the slave
11. MBUS3 AUTO MESSAGE GENERATOR 28 MBUS3 AUTOMATIC ADDRESSING 2 2ccccecceseceeeececceeecaneeceseceeecaeceeeecesecaeeecesaseecateeaeeeseseeaeeens 30 MBUS3 AUTOMATIC SLEEP 30 MBUS3 INSTALLATION AND BINDING 31 Mee ed ON 31 MBUSS See 32 MBUS3 TIMING TABLE 33 MBUS3 CONFIGURATION COMMANDS 34 APPENDIX MBUS COMMAND LIST OVERVIEW I I aaa 39 APPENDIX CONFIGURATION MEMORY FACTORY DEFAULT 40 APPENDIX ASCII TABLE s sssssccssceccescececcesceccecceccsceeccacsecsecscesecaceeseaseesesacsseassansneeeeseass 42 DOCUMENT REVISION HISTORY s sccsccsccescececcssceccssceceenseceecseesecsceeseaceecsasaceeseasearseeseeseass 43 DISCLAIMER 43 GEGEN 43 LIFE SUPPORT POLICY c csscescsseeccessecescsececescesccaceecncaseaesaccaeseesecaceaseacaesacaeeeseaceassneseeeeats 43 CONTACT INFORMATION csccecccsseccecescecceceeccssseccarsccsecaceessacseesecaceaseaccaeseesaeaceassnsenesneaeesnens 43 2010 Rad
12. from Master 0x00 will clear all flags Bind B 0x42 Register number 1 8 followed by Used to bind slaves to 8 byte address same order as for master Data stored in Destination module address non volatile memory Channel C 0x43 0x01 0x0C 1 10 Data is stored in volatile Apply for R mode only memory only Decrypt D 0x44 One byte bitmap address register Sets bitmap for decryption 1is LSB of data 0x00 will clear all flags Encrypt 0x45 One byte bitmap address register Sets bitmap for encryption 1is LSB of data 0x00 will clear all flags C field F 0x46 0x00 0xFF 0 255 Data is stored in volatile memory only M Bus mode G 0x47 0x00 0x04 0 4 Data is stored in volatile 0 5 memory only 1 T1 2 T2 S and R mode not 3 Reserved supported in NTA8130 4 R Install P 0x49 0 Normal operation In install mode messages 1 Install mode with C field 06h and 46h 2 Accept all messages are accepted Use in Master only Key register K Ox4B Slave 16 byte key Used to set encryption Master key Data stored in non Register number 1 8 followed by volatile memory 16 byte key Memory M Ox4D Address Data see list of Used to enter memory configuration parameters below configuration menu OxFF exits memory configuration Parameters changed are stored in non volatile memory Output power P 0x50 0x01 0x05 1 5 Data is stored in volatil
13. immediate prompt To coNFIG 1 1 ms Delay after new M Bus mode byte is sent until prompt gt For other volatile memory commands there is delay but immediate prompt Twat 1 55 ms B K and M Delay from stop bit of the command byte to start bit of command the prompt reply See figure 5 for details 24 us all other commands TMEMORY CONFIG 31 ms In this period the internal flash non volatile memory is programmed Do not reset turn the module off or allow any power supply dips in this period as it may cause permanent error in the Flash configuration memory After the last command parameter byte the host should wait for the gt prompt before any further action is done to ensure correct re configuration TCONFIG IDLE 1 1 ms End of X to IDLE trx 3 6 ms TX time for T1 mode when Length 1 on the UART Preamble sync CRC and MBUS address field added internally Depends on M Bus mode T S R and L 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 22 of 43 Radiocrafts MBUS2 Configuration Commands MBUS A list of commands is shown in the table below Commands must be sent as ASCII characters or their corresponding binary value All arguments must be sent as binary values to the module not as ASCII representation for hex or decimal Acknowledge 0 41 One byte bitmap address register Sets bitmap for 1 is LSB acknowledge
14. many meters The Access Number will automatically be increased for every transmission if set to zero The RSSI of the last received packet will automatically be added in the Status byte by the module if set to Zero Note if the Template message requires encryption as determined by the signature and the Encryption enable flag the time to encrypt the message on the fly might violate the 2 3 ms response time in T mode Templates with more than one block to be encrypted can only be used for S mode up to 50 ms response time In this case the pre encrypted mailbox message must be used MBUS3 Automatic Addressing When the Master receives a message from a slave this slave s address will be used as the Application Layer Address for the next transmission from the master when using the auto message feature When messages are sent from the UART buffer the Application Layer Address used is determined by the host Note the Link Layer Address in the MAC header is always the masters own address as stored in the configuration memory The Link Layer Address stored in configuration memory can be overridden by using the T command volatile memory or permanently changed using the M command non volatile memory MBUS3 Automatic Sleep The Slave has special support for automatic sleep after data transmission If automatic SLEEP after TX is enabled SLEEP_MODE 1 the module will automatically go to sleep in a configurable time after da
15. memory in the module 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 3 of 43 Radiocrafts MBUS feature sets This User Manual describes the embedded protocol of the Wireless MBUS Modules from Radiocrafts The MBUS firmware is available as different feature sets targeting specific applications The hardware has the same size and pin out for all frequency versions and the different feature sets available are listed in the table below The feature sets and the embedded functions are independent of the frequency so this user manual is valid for all versions RC 11xx MBUSx Detailed information on how to use the different feature sets is found in this User Manual Additional information about the Wireless M Bus packet structure for NTA 8130 compliance is described in Application Note 011 and is available on request MBUS General Basic wireless M bus Added features for Added features for OMS functions DSMR NTA 8130 compliance compliance Network role Master or Slave Master or Slave Master Slave or Repeater Modes 1 S2 T1 T2 R2 T1 T2 1 S2 T1 T2 Encryption No must be handled AES according to NTA AES according to OMS externally 8130 mode 4 and 5 mode 4 and 5 Installation No Must be handled Yes according to NTA Yes according to OMS mode externally 8130 Number of None Up to 8 Up to 64 installed meters Filter function No receives any MBUS packet Filtering must be handled externally Mas
16. read back the value and write it back after the upgrade LED CONTROL Ox3A 0 Disabled 0x00 0 Use to enable 1 RX TX indicator LEDO LED1 for RX TX 2 UART RF IDLE packet indication or indicator UART RF IDLE mode indicator CONTROL FIELD C field Ox3B 0x00 0xFF 0x06 6 Use F command to 0 255 change value in volatile memory only RX TIMEOUT Ox3C 0x00 0xFF OxOB 11 Delay before Sleep 0 255 mode n x 0 6 ms INSTALL MODE Ox3D 0 Normal mode 2 accept installed MBUS meters only 1 Install mode 2 Filter off accept all MBUS types ENCRYPT FLAG Ox3E 0 Bit mask for encryption enabled when set DECRYPT FLAG Ox3F 0 Bit mask for decryption enabled when set DEFAULT KEY 0x40 All 0xFF 0x4F 255 INIT_VECTOR 0x50 All 0x00 Ox5F 0 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 26 of 43 Radiocrafts MBUS PART NUMBER 0x60 RCxxxx 0x6B MBUS2 HW_REV_NO 0x6D X yz x y and z Any number 0x72 0d 9d FW_REV_NO 0x74 X yz x y and z Any number Ox77 Od 9d ADDRESS 101 0x80 All 0x00 Address for installed 0x87 meters ADDRESS ID2 0x88 All 0x00 Address for installed Ox8F meters ADDRESS ID3 0x90 All 0x00 Address for installed 0x97 meters ADDRESS_ID4 0x98 All 0x00 Address for installed Ox9F meters ADDRESS 105 All 0 00 Address for installed OxA7 meters ADDRESS 106 OxA8 All 0x00 Address for installed OxAF meters ADDR
17. received from several meters the last message received will be the default address This feature can be overridden by using the T command MBUS2 Automatic Sleep The Slave has special support for automatic sleep after data transmission If automatic SLEEP is enabled SLEEP MODE 1 the module will automatically go to sleep in configurable time after data transmission if acknowledge is not received The receiver timeout after slave TX is configured by RX TIMEOUT If acknowledge is received after the slave transmission the slave goes to sleep for 100 ms before it goes into RX for 10 ms waiting for a new Master message This reduces the burden of the slave host controller when meeting NTA 8130 v 3 0 data exchange timing A OxFF byte will wake up a sleeping Slave into a low power idle mode IDLE The Slave will only accept UART input RXD UART in this IDLE mode to save current The current saving depends on UART rate and gives less current consumption for low UART rates but data transfer takes longer time The figure below illustrates current vs time for a Slave configured for auto sleep at 2 4 kBaud UART rate when receiving acknowledge from Master after the first transmission Current vs time for Auto sleeping slaves 2 4 kbaud UART I mA RX TIMEOUT 100 ms 10 ms d lt s lt gt 20 17 x lt k sk t iss z 5 8 8185 85 s Sc i Sigs gt gt gt s Slave TXD UART s
18. the RF CHANNEL RF DATA RATE configuration registers This setting can also be used for T2 mode slave receive and master transmit T1 mode Set MBUS MODE 1 The RF channel channel 12 data rate 100 kchip s and preamble length are set internally in the module according to the T mode and will override any settings in the RF CHANNEL RF DATARATE and PREAMBLE LENGTH configuration registers This setting can also be used for T2 mode slave transmit and master receive T2 mode Set MBUS MODE 2 Set NETWORK ROLE 0 or 1 The RF channel channel 11 or 12 data rate 32 768 or 100 kchip s and preamble length are set internally in the module according to the T2 mode and the selected Network Role either being a Slave NETWORK ROLE 0 or a Master NETWORK ROLE 1 and change according to receive transmit It will override any setting in the RF CHANNEL configuration register R2 mode Set RF CHANNEL 1 10 Set MBUS MODE 4 The data rate 4 8 kchip s and preamble length are set internally in the module according to the R mode The module supports automatic generation of the Wireless M Bus frame i e Preamble header synchronisation Adding the first block C field and address manufacturing ID CRC Postamble The RF signal is Manchester coded or 3 out of 6 coded for increased signal integrity The default M Bus mode is entered and stored in the modules non volatile memory MBUS MODE The M Bus mode can als
19. will be ignored and the gt prompt will be re sent If Test mode 1 or 2 is used it is important to enter Test mode 3 before exiting the configuration mode X in order to ensure proper operation in normal mode Example To select RF channel 3 send the follow sequence after asserting the CONFIG line and the gt prompt is received Command Hex Enter 0x00 0x43 3 0x03 Response gt gt gt new command could be issued here X 0x58 none Comment Note Or assert CONFIG pin De assert CONFIG after gt prompt Wait for gt prompt Module returns to IDLE state Note that the CONFIG line must be de asserted after the first gt prompt was received but before the X command 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 24 of 43 Radiocrafts MBUS2 Configuration Memory The table below shows the complete list of configurable parameters stored in non volatile memory These values can be changed using the M command All addresses and arguments must be sent as binary values to the module not as ASCII representation for hex or decimal Radio configuration MBUS RF CHANNEL Default RF 0x00 1 10 0x01 1 See data sheet for channel for R channel frequencies mode only Only used for R mode RF POWER Default RF 0x01 1 5 0x05 5 See data sheet for output output power power levels MBUS
20. And the slave host should configure this new key into the module using the K command followed by 16 bytes the encrypted key The slave module will automatically de crypt the new key using its default key The master host should then send the new plain key to the master module using the K command followed by the register location number and the 16 bytes the new key The register location number must correspond to the address register location for that slave The ENCRYPT_FLAG and DECRYPT_FLAG parameters are used to enable disable the encryption when transmitting and receiving messages The 8 bit values are interpreted as bit maps corresponding to the 8 address registers LSB being register 1 For a message to be encrypted the encryption flag for the particular slave must be set and the Cl field and Signature field sent to the module must be according to the standard for encryption to take place The module will do byte stuffing if required to get a full 16 byte encryption block Only Cl fields 0x5A 0x5B and 0x72 allows encryption The Signature field must be encryption mode 0x04 or 0x05 according to NTA 8130 When using Signature field 0x05 the application must add the two encryption verification bytes 0x2F after the header The Initialization Vector for the encryption is extracted from the long header for Cl fields 0x5B and 0x72 For the short header Cl field 0x5A the Initialization Vector is partly from the MAC header destin
21. ESS 107 OxBO All 0x00 Address for installed 0xB7 meters ADDRESS 1D8 0xB8 All 0x00 Address for installed OxBF meters SERIAL NUMBER 0xC0 All 0x00 8 bytes reserved for serial 0xC7 number for traceability Is programmed by Radiocrafts during test Exit from memory OxFF No argument To exit from command configuration should be sent mode the X command must be sent after gt is received To make permanent changes to default values and other parameters the Memory Configuration command M is used This command should be followed by pairs of byte being the memory address and the new value to be stored at that address In order to exit the Memory Configuration mode the address OxFF must be sent but without any data argument Then wait for the gt prompt while the internal memory is re programmed See Timing Information for typical delay To completely exit from command mode the normal exit command X must be sent Example To change the MAN_ID at address 0x19 and 0x1A and set it to 100 200 0x64 0xC8 send the following sequence Command Enter 0x19 100 Ox1A 200 Hex 0x00 0x19 0x64 Ox1A 0xC8 Response m address could be sent here new value could be sent here OxFF x OxFF 0x58 none Comment Note Or assert CONFIG pin De assert CONFIG after gt prompt Modul
22. Information it is ready to receive data on the UART or from the air The SLEEP command can be used for both Master and Slave All configuration settings and RAM values are retained during SLEEP If the module is shut completely off supply power turned off all configuration settings in non volatile memory is restored but values in RAM are overwritten with default settings RSSI Reading The module provide a digital Received Signal Strength Indicator RSSI through the S command or attached to the received messages The RSSI value appended to a received message is the signal strength of that received packet The RSSI value is an 8 bit character one byte indicating the current input signal strength or the signal strength of the received message The signal strength can be used as an indication of fading margin or as a carrier sense signal to avoid collisions The RSSI value increases with increased input signal strength in 0 5 dB steps Input signal strength is given by typ RSSI 2 dBm 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 12 of 43 Radiocrafts MBUS1 Description MBUS1 Timing table The table below shows the timing information for the module when changing between different operating states Timing symbols are according to figure 5 and 6 MBUS trx TXD 180 us Time from last byte is received from the air until first character is sent on the UART trxp M
23. MBUS User Manual rev 1 40 Page 29 of 43 Radiocrafts e MBUS IMPORTANT NOTE The binding B command and Encryption Key entry K command will erase the Mailbox due to memory constraints in the module Mailboxes can be written and read using the W write command and the R read command The format for writing to the mailbox is Mailbox number C field Length Cl field followed by the rest of the message The Mailbox number should be 1 15 There is no restriction on the C field value but do note that OMS specify only a set of allowable C fields The Length byte shall be the number of bytes following not including the Length byte itself Note if the message including C and Length is more than 64 bytes the following mailbox cannot be used Long mailbox messages must be pre encrypted in order to meet the time constraints in T mode This is done by using the E command If the message holds a valid address and the signature is set for encryption and the Encryption flag is disabled the message will be encrypted and stored in the Mailbox Note if the Encryption flag is not disabled the message will be encrypted again when transmitted If the message in the mailbox has an Application Layer Address 0 Access Number 0 and Status 0 the message is called a template When using a template the blank fields will be added on the fly when responding to the slave This makes it possible to point at the same Template message for
24. O Ox4F Register number 1 64 Module responds with the message flags auto message flags 2 bytes Output power P 0x50 0x01 0x05 1 5 Data is stored in volatile memory only Quality 0x51 Returns one byte indicating Based on bit errors Indicator the signal quality of the last preamble and synch word received packet Read mailbox R 0x52 Register number 1 64 Will send the selected mailbox content to the UART 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 34 of 43 Radiocrafts MBUS Signal S 0x53 Returns one byte indicating If a valid packet has been Strength the signal strength of a received when in RSSI detected signal or a valid configuration mode it will packet return the RSSI of the last received packet Destination T 0x54 8 bytes Data is stored in volatile module M_ID2 memory only address M_ID1 U_ID4 U_ID3 U_ID2 U_ID1 VER Version DEV Device Type Write mailbox W 0x57 Register number 1 64 followed by C L CI and the rest of the message Exit command X 0x58 none Exit to normal operation mode All changes of parameters take effect Sleep mode Z 5 none Exit sleep mode by sending 0xFF on UART RXD pin Test mode 0 0 0x30 List all configuration memory parameters Test mode 1 1 0x31 Test mode 2
25. OxFF 0x08 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x37 0x05 0x08 0x00 0x01 0x05 0x00 0x00 0x01 0x38 Ox3F 0 2 0x00 0x00 0x06 0x06 0x02 0x00 0x00 0x40 0x47 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF Ox48 Ox4F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x50 0x57 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x58 0x5F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x60 0x67 0x00 0x52 0x43 0x31 0x31 0x38 0x30 0x2D 0x68 0x6F Ox4D 0x42 0x55 0x53 0x33 0x2C 0x32 Ox2E 70 0 77 0x30 0x30 0x2C 0x33 0x2E 0x30 0x30 0x00 0x78 0x7F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x80 0x87 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x88 0x8F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x90 0x97 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0x98 0x9F OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxAO OxA7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxA8 OxAF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxBO OxB7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxB8 OxBF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0xC0 0xC7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0xC8 OxCF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF 0 00 0 07 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxD8 OxDF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxEO OxE7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxE8 OxEF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFO OxF7 OxFF OxFF OxFF OxFF OxFF OxFF OxFF OxFF
26. Radiocrafts MBUS User Manual Water meter Q 300 Gas meter N Concentrator Heat meter 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 1 of 43 Radiocrafts Embedded Wireless Solutions M B U S Table of contents TABLE OF CONTENTS cccecceccsscececcesceccsscececseseecscesecscesecacecsecsecsneaccansecseceseaecaeeeesaseeseneaseaseass 2 TG GR 3 MBUS FEATURE SETS rersesvnnnrnensvrnennenveressvsnennervernenversenessenvessenveressvenennenvennenvensenensennenrennenennn 4 OPTIONAL CUSTOM SPECIFIC VERSION eene I naa 4 IMPORTANT NOTE ON PATENT PENDING TECHNOLOGY 5 INTRODUCTION NETWORK 5 WIRELESS M BUS EMBEDDED PROTOCOL 6 BASIC FUNGTIONALITY E agenda 6 UART INTERFACE FOR WIRELESS M BUS PACKET HANDLING 7 FRAME FORMAT FOR TRANSMITTING DATA 8 FRAME FORMAT FOR RECEIVING DATA 8 UART INTERFACE FOR MODULE CONFIGURATION 9 UART TIMING INFORMATION 10 PO
27. WER MANAGEMENT a 12 ESSEN 12 HESS e G 13 MBUS1 TIMING TABLE 13 MBUS1 CONFIGURATION COMMANDS 14 MBUS1 CONFIGURATION MEMORY 16 MBUS2 DESCRIPTION sssccssceccsseeccesseceecseceecsceeccasecsecaccaesaecarsecsecaceaseaceesaeaceeseaseassneseeeeass 18 MBUS2 AUTOMATIC ACKNOWLEDGE 18 MBUS2 AUTOMATIC ADDRESSING 18 MBWS2 AUTOMATIC SLEEP bet unutaqa a Desc 18 MBUS2 INSTALLATION AND BINDING 19 MBUS2 ENGRYPTION u ss 19 MBUS2 TIMING TABLE 22 MBUS2 CONFIGURATION COMMANDS 23 MBUS2 CONFIGURATION MEMORY 25 MBUS3 DESCRIPTION 28
28. _MODE M Bus mode 0x03 0 4 0x01 1 Use G command to 0 S change value in volatile 1 T1 memory only 2 T2 3 Reserved S and R mode not 4 R supported in NTA8130 SLEEP_MODE Sleep mode 0x04 0 Disable Sleep 0x00 0 When enabled the 1 Enable Sleep module enter Sleep mode 3 Enable with after transmission Delay sleep timeout set by RX_TIMEOUT If enabled with sleep timeout the module goes directly to Sleep after a Reset and to Sleep after TIMEOUT when wakeup from Sleep or exit Config mode RSSI_MODE Append RSSI 0 05 0 Disabled 0x00 0 When enabled the RSSI to received 1 Enabled value is appended to the data received data TIMEOUT Time before 0x10 lt 1 254 gt 0x7C IF SLEEP_MODE 3 the modem clear 0x01 1 32 ms same timeout is used to buffer without 0x02 2 48 ms auto sleep slaves transmitting if 0x03 3 64 ms Buffer size lt Ox7C 124 2 s Modem transmit without Length byte OxF9 249 4 s timeout when first byte Buffer size length byte Radio packet configuration PREAMBLE _ Short of long OxOA 0x00 0 Short 0x00 0 Preamble header LENGTH preamble in S 0x01 1 Long length apply for S mode mode only only Medium access addressing and network management NETWORK_ROLE 0x12 0x00 0 0x00 0 Slave Meter 0x01 1 Master Concentr ator M_ID1 Manufacturer 0x19 0x00 0xFF 0x0C 12 ID first byte 0 255 M_ID2 Manufacturer Ox1A 0x00 0xFF OxAE ID second byte 0 255 174 U_ID1 Unique ID f
29. ample To change the MAN ID at address 0x19 and 0x1A and set it to 100 200 0x64 0xC8 send the following sequence Command Hex Response Comment Note Enter 0x00 gt Or assert CONFIG pin De assert CONFIG after gt prompt M 0x4D gt Module ready to receive address 0x19 0x19 none 100 0x64 none 0x1A Ox1A none 200 OxC8 none new address could be sent here new value could be sent here OxFF OxFF gt Wait for gt prompt X 0x58 none Module returns to IDLE state Test mode 0 0 command can be used to list all parameters stored in non volatile memory This command can be used to verify and check the module configuration 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 17 of 43 Radiocrafts Erhendea Wireless e MBUS MBUS2 Description MBUS2 Automatic Acknowledge The Master must reply with an acknowledge message within 3 ms after a received Access Demand if further communication shall take place To meet this timing requirement the module has built in automatic acknowledge support Use the Acknowledge flag set using the A command to indicate which slave shall be acknowledged at the next access The flag is automatically cleared but can also be cleared manually with the A command MBUS2 Automatic Addressing When the Master receives a message from a slave this slave HEADER will be used as the HEADER for the next transmission from the master If for example during installation messages are
30. and a Mailbox Auto message Flags set using the A command are used to indicate which slave shall be replied at the next access The flag is automatically cleared when a reply is sent when enabled but can also be cleared manually with the A command For each address register there is a corresponding flag register two bytes SSSSSSSS E D FCB R MB Where SSSSSSSS selects the standard message see below E is the Encryption flag bit D is the Decryption flag bit FCB is the Frame Count Bit to be used in the next transmission R is one bit reserved for future use MB is the Mailbox selected by 4 bits 0000 to 1111 where 0000 means none The flags are set by using the A command First send the register number followed by the two bytes The flags are stored in volatile memory and will be lost during power off The E and D flags can be set by default for all register positions using the ENCRYPT and DECRYPT configuration parameter The MAILBOX configuration parameter is used to set certain features of the Auto message Generator RRR ACSM ACMB AMMB DFC A Where RRR are three bits reserved for future use ACSM is the Auto Clear Standard Message bit ACMB is the Auto Clear Mailbox bit is the Accept all Messages C fields for Mailbox transmission bit DFC is the check Data Flow Control bit in the C field A is the check Accessibility bit If the ACSM or ACMB bit is set the auto message flag will be automatically cleared after a tr
31. and mode the normal exit command X must be sent Example To change the MAN_ID at address 0x19 and 0x1A and set it to 100 200 0x64 0xC8 send the following sequence Command Enter 0x19 100 Ox1A 200 Hex 0x00 0x19 0x64 Ox1A 0xC8 Response e m none none none none new address could be sent here new value could be sent here OxFF x 2010 Radiocrafts AS OxFF 0x58 MBUS User Manual rev 1 40 none Comment Note Or assert CONFIG pin De assert CONFIG after gt prompt Module ready to receive address Wait for gt prompt Module returns to IDLE state Page 38 of 43 Radiocrafts MBUS Test mode 0 0 command can be used to list all parameters stored in non volatile memory This command can be used to verify and check the module configuration Appendix MBUS Command list overview A 0x41 N A Acknowledge N A controlled in flag register B 0x42 N A Bind Bind C 0x43 Channel Channel Channel D 0x44 N A Decrypt RF message before N A controlled in flag register send to UART E 0x45 N A Encrypt UART message Encrypt mailbox message before RF transmit F 0x46 C field C field C field G 0x47 M Bus mode M Bus mode M Bus mode T 0x49 N A Install Install K 0x4B N A Key register Key r
32. ansmission If the DFC bit is set the DFC bit of the incoming message in the C field will be checked before an auto message is sent otherwise it will be ignored and the message sent regardless of the incoming message If the A bit is set the Accessability of the incoming message in the Application Header signature will be checked before an auto message is 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 28 of 43 Radiocrafts Amedeed Wireless MBUS sent only to meters that signals they are accessible otherwise it will be ignored and the message sent regardless of the incoming message The Auto message Generator supports three types of messages e Standard messages with fixed frame format e Message from a mailbox Atemplate messages from a mailbox There are several standard messages that can be sent depending on the incoming message from the slave The master module will automatically recognize the type of message and reply accordingly The table below shows which messages can be sent for each incoming message and the corresponding flags SSSSSSSS for the master reply Standard messages shown in green cells messages from the mailbox in red cells 10000000 01000000 00000000 No reply lt 00100000 REQ UD1 00010000 REQ UD2 00001000 Reserved 00000000 No reply 00000100 REQ UD1 00000010 REQ UD2 00000001 SND NKE Note the module will automatically set the Frame Count
33. ation address and the short application header The Access Counter byte in the application header is used by the encryption and the host application must increment the counter in order to avoid repetitive messages For a message to be decrypted the decryption flag for the particular slave must be set and the Cl field and Signature field must be according to the standard for encryption to take place In the slave only LSB is used as a flag for encryption decryption 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 19 of 43 Radiocrafts Embedded Wireless Solutions M B U S The D and E commands are used to set decryption and encryption flags without storing in non volatile memory The value following the D and E commands is interpreted as bit maps corresponding to the 8 address registers To test the encryption feature you need to have a valid key set for the master and the slave In addition you need to send a valid UART frame into the module in order for the internal encryption and decryption feature to be activated on this message The RCTools PC software from Radiocrafts IMBUS_CCT and MBUS DEMO be used to configure key sets and send and receive encrypted messages Example of a key set Master Key 0x00 0x11 0x22 0x33 0x44 0x55 0x66 0x77 0x88 0x99 0xAA 0xBB 0xCC 0xDD 0xEE 0xFF Slave Key 0x0A 0x90 0xE5 0xB7 0x4D 0x28 0x07 0xA6 0x51 0xF6 Ox9A OxCO 0x89 0x6A 0x09 0xF6 Use factory default for Init vector and Defau
34. ceived frame a special string can be used By setting DATA INTERFACE 3 the two byte string 00 E5h i e L 0 will be sent on the UART when an empty acknowledge frame is received Application data CI APPL DATA is always present except when only a HEADER is transmitted For host applications using a UART buffer the timing information used for parsing could be lost In this case a start and stop byte can be used Setting DATA INTERFACE 4 will add a 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 8 of 43 Radiocrafts START byte 68h and a STOP byte 16h to the message This is only used for the module to host communication direction TXD Setting DATA INTERFACE 8 will add a two byte CRC checksum and DATA INTERFACE OCh will add START STOP bytes and CRC The CRC is sent MSByte first The RSSI value is added when RSSI MODE 1 UART Interface for Module Configuration The configuration of the module can be changed in circuit from the host during operation at the time of installation of the equipment at the manufacturing test or even as a stand alone module The configuration is changed by sending commands on the UART interface after the module is set in configuration mode The configuration mode is entered by sending 00h to the module or by asserting the CONFIG pin set low In configuration mode the module will respond by sending a gt prompt on the TXD pin This indicates that the mo
35. d First character on Last character on UART TXD UART TXD trxp crs trx tracker TIMEOUT i i 1 First character on Last character on UART RXD UART RXD trxapee IDLE torr DLe OFF y IDLE fRESET IDLE RESET 4 IDLE fsLeEP DLE SLEEP IDLE tconric prompr te conric teonric DLe IDLE m CONFIG CONFIG IDLE C X CONFIG set low MEMORY CONFIG TCONFIG IDLE CONFIG MEMORY CONFIG CONFIG IDLE M OxFF UC Figure 6 UART timing diagram Timing values are shown in the timing table for each MBUS feature set 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 11 of 43 Radiocrafts Erhendea Wireless e LL MBUS Power Management The module can be set in SLEEP mode in order to reduce the power consumption The low power SLEEP mode is manually entered by using the SLEEP command 2 after the module is set in configuration mode It is also possible to configure the module to enter SLEEP automatically after a message has been transmitted SLEEP MODE 1 With this setup the module has to enter TX mode transmit a message after power on before entering SLEEP mode first time In SLEEP mode the module will not receive or detect incoming data neither from the host UART port nor from the air The module is awakened from the SLEEP mode by sending the wake up byte FFh on the UART RXD line use a UART Baud rate 4 8 kBd due to a maximum pulse length requirement After the module has woken up see Timing
36. dule is ready to receive commands The CONFIG pin if used can then be de asserted Note that the CONFIG pin must be de asserted before the Exit command X is sent to the module in order to return to normal operation After a command is executed the module responds with the gt prompt character again indicating it is ready for anew command Do not send a new command before the gt prompt is received The time required to execute a command can vary depending on the command see the Timing Information section There is no gt prompt after the X exit command The parameters that are set by dedicated configuration commands C P etc take immediate effect after returning to normal operation IDLE but will not be stored in non volatile memory and will be lost in case the supply power is turned off or if the module is reset These parameters are for example the radio channel and output power Permanent changes of parameters can be done by writing to the configuration memory using the memory command M These are for example default radio channel default output power and M Bus mode see the Configuration Memory section for details The flow diagram bellow illustrates how to use the UART interface to enter configuration mode change configuration parameters and return to IDLE mode endcommandbyietom New command Figure 4 Configuration mode flow diagram Send X to RXD
37. e memory only Quality Q 0x51 Returns byte indicating the Based on bit errors Indicator signal quality of the last received preamble and synch word packet Signal S 0x53 Returns one byte indicating the If a valid packet has been Strength signal strength of a detected signal received when in RSSI or a valid packet configuration mode it will return the RSSI of the last received packet Destination 0x54 8 bytes Data is stored volatile module M_ID2 memory only address M_ID1 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 23 of 43 Radiocrafts MBUS U U_ID3 U ID2 U ID1 VER Version DEV Device Type Exit command X 0x58 none Exit to normal operation mode All changes of parameters take effect Sleep mode Z 5 Exit sleep mode by sending 0xFF on UART RXD pin Test mode 0 0 0x30 List all configuration memory parameters Test mode 1 T 0x31 TX carrier Test mode 2 2 0x32 none TX modulated signal PN9 sequence Test mode 3 3 0x33 TX Off RX mode Note ASCII characters are written as X hexadecimal numbers are written like 0x00 and decimal numbers are written like 10 throughout the text A table of ASCII characters and their respective hex and decimal values are found in the Appendix Any invalid command
38. e ready to receive address Wait for gt prompt Module returns to IDLE state Test mode 0 0 command can be used to list all parameters stored in non volatile memory This command can be used to verify and check the module configuration 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 27 of 43 Radiocrafts FPP MBUS MBUS3 Description The OMS specification differs from NTA 8130 in the way the communication session between a slave meter and master MUC is done For battery operated devices the slave is always initiate the communication and the master must then transmit if any within a short time window 2 3 ms the T mode After one such ping pong sequence the slave will have a pause enter sleep mode for 2 5 seconds before it again do a new transmission allowing the master to do another transmission This means that all messages to be sent from the master must be ready and transmitted within a very short time The MBUS3 Auto message generator and Mailbox features make this task easy and doable The installation scenarios in OMS are supposed to support many meters per MUC hence the address and registers has been extended to 64 positions in MBUS3 MBUS3 Auto message Generator In T mode the Master must reply with a new message within 3 ms after a received Access Demand if further communication shall take place To meet this timing requirement the module has built in an Auto message Generator
39. ed decrypted even if the flags are set MBUS3 Repeater The MBUSS feature set contains complete autonomous unidirectional repeater functionality The module can be configured as a Repeater by setting NETWORK_ROLE 2 The MBUS MODE must be set to 0 S mode or 1 T1 mode The Repeater operates as a stand alone unit after power on no installation is required The Repeater should be mains powered as its receiver is working continuously The Repeater can handle up to 15 messages simultaneously each with a random delay before the transmission The Repeater will repeat all SND NR and SND IR messages within reach after a random delay of 5 25 seconds with the hop counter set to 1 If it is a SND IR message the repeater will in addition generate a SND NKE message after 2 5 seconds to indicate it is within range to support an installation tool The SND NKE message contains the RSSI level for the received SND IR message The Repeater generates a SND NR management message every 240 minutes This message indicates that the Repeater is alive and working The Repeater can be set in Installation mode by activating setting low the Install button input pin 25 Demo Board S5 for lt 1 second The LED driver output pin 29 Demo Board D1 red LED will blink rapidly when in Installation mode In Installation mode the module transmits SND IR every 30 60 seconds After 90 transmissions it returns to normal mode The installation mode can also be
40. eep 0 255 mode n x 0 6 ms 0x06 6 3 ms Minimum 3 ms 6 in T 0x56 86 50 mode minimum 50 ms ms 86 in S mode INSTALL MODE 0x3D 0 Normal mode 2 accept installed MBUS meters only 1 Install mode 2 Filter off accept all MBUS types ENCRYPT FLAG Ox3E 0 Disabled 0 Default setting for 1 Enabled encryption enabled when set DECRYPT FLAG Ox3F 0 Disabled 0 Default setting for 1 Enabled decryption enabled when set DEFAULT KEY 0x40 All 0xFF 0x4F 255 INIT_VECTOR 0x50 All 0x00 0x5F 0 PART NUMBER 0x60 RCxxxx 0x6B MBUS3 HW_REV_NO 0x6D X yz x y and z Any number 0x72 0d 9d FW_REV_NO 0x74 X yz x y and z Any number 0x77 0d 9d SERIAL_NUMBER 0xC0 All 0x00 8 bytes reserved for serial 0xC7 number for traceability Is programmed by Radiocrafts during test Exit from memory OxFF No argument To exit from command configuration should be sent mode the X command must be sent after gt is received To make permanent changes to default values and other parameters the Memory Configuration command M is used This command should be followed by pairs of byte being the memory address and the new value to be stored at that address In order to exit the Memory Configuration mode the address 0xFF must be sent but without any data argument Then wait for the gt prompt while the internal memory is re programmed See Timing Information for typical delay To completely exit from comm
41. egister L x4C N A N A List Binding M 0x4D Memory configuration Memory configuration Memory configuration N 0x4E N A N A Access number O 0x4F N A N A Read Auto message flag register P 0x50 Output power Output power Output power Q 0x51 Quality Indicator Quality Indicator Quality Indicator R 0x52 N A N A Read Mailbox S 0x53 Signal Strength RSSI Signal Strength RSSI Signal Strength RSSI T 0x54 Destination address Destination address Destination address W 0x57 N A N A Write Mailbox X 0x58 Exit command Exit command Exit command Z Ox5A Sleep mode Sleep mode Sleep mode 0 0x30 Test mode 0 Test mode 0 Test mode 0 1 0x31 Test mode 1 Test mode 1 Test mode 1 2 0x32 Test mode 2 Test mode 2 Test mode 2 3 0x33 Test mode 3 Test mode 3 Test mode 3 4 0x34 Test mode 4 Test mode 4 Test mode 4 Commands in grey are stored in non volatile memory The rest of the commands are stored in volatile memory and is lost after a power off or a reset 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 39 of 43 Radiocrafts s MBUS Appendix Configuration Memory Factory Default 0x00 0x07 0x01 0x05 0x03 0x01 0x00 0x00 0x64 0x00 0x08 0x0F 0x00 0x00 0x00 0xD3 0x91 OxDA 0x80 0x80 10 0 17 Ox7C 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x18 0x1F 0x00 0x0C OxAE 0x12 0x34 0x56 0x78 0x01
42. encryption is extracted from the long header for Cl fields 0x5B 0x60 0x64 0x6C Ox6D 0x72 Ox7C Ox7E 0x80 and 0x8B For the short header CI field fields 5 0x61 0x65 0x7D Ox7F and 0x8A the Initialization Vector is partly from the MAC header destination address and the short application header The Access Counter byte in the application header is used by the encryption and the counter must be incremented in order to avoid repetitive messages When using the mailbox template the counter is automatically incremented by the module For a message to be decrypted the decryption flag for the particular slave must be set and the Cl field and Signature field must be according to the standard for encryption to take place 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 31 of 43 Radiocrafts Em MBUS In the slave register 1 is used to hold the flags for encryption decryption The set flags command A is used to set decryption and encryption flags without storing in non volatile memory The E command can be used to encrypt a message in the Mailbox as described above Note that you also have the option to use the M command to permanently set the Encryption Decryption flag in the configuration non volatile memory instead of using the A command Encryption decryption will only take place when the signature field indicate mode 0x04 or 0x05 If encryption mode 0x00 is used the message will not be encrypt
43. ered via an UART command and wake up is triggered on UART traffic one FFh byte Sleep mode can also be entered automatically after a transmission configurable by SLEEP_MODE The module acts as a buffered packet radio hence all data to be sent is stored in the module before they are transmitted by the RF circuitry Likewise when data is received they are stored in the module before they are sent to the host This allows the communication controller to add address information CRC and encryption during transmission and to do error check and decryption of the received data The Module has an UART interface that is used for both Wireless M Bus packet data and module configuration UART Interface for Wireless M Bus packet handling The host use the UART Interface to send and receive Wireless MBUS data The UART packet format can be changed in the configuration mode When the Module receives a Wireless M Bus packet over RF it will send the packet over the UART interface on the TXD Line When the host MCU wants to transmit a Wireless M Bus packet over the RF it must send the packet through the UART Interface on the RXD line Wireless M Bus link TXD MCU RC1180 MBUS gt RC1180 MBUS m Figure 1 UART interface overview 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 7 of 43 Radiocrafts Frame format for transmitting data The data frame for the UART RXD pin input for transmitting a Wireless M Bus packet is built li
44. essage flags flags followed by 2 bytes for the Master and encryption flags Bind B 0x42 Register number 1 64 Used to bind slaves to followed by 8 byte address master Data stored in NB Use application layer non volatile memory format NOT the same order as for Destination module address in link layer Channel C 0x43 0x01 0x0C 1 10 Data is stored in volatile Apply for R mode only memory only Encrypt E 0x45 Mailbox number 1 15 C field F 0x46 0x00 0xFF 0 255 Data is stored in volatile memory only M Bus mode G 0x47 0x00 0x04 0 4 Data is stored in volatile 0 52 memory only 1 T1 2 T2 R mode not supported in 3 S1 OMS 4 R Install 0x49 0 Normal operation In install mode messages 1 Install mode with C field 06h and 46h 2 Accept all messages are accepted Use in Master only Key register K Ox4B Register number 1 64 Used to set encryption followed by 16 byte key Slave key Data stored in non must use register 1 volatile memory List binding L 0x4C Register number 1 64 Module responds with the address stored in the register 8 bytes Memory M 0x4D Address Data see list of Used to enter memory configuration parameters below configuration menu 0xFF exits memory Parameters changed are configuration stored in non volatile memory Access N 0x4E 0x00 OxFF 0 255 Set new Access Number Number Read AutO
45. ication sequence Note there is a difference in the addressing scheme between NTA 8130 and OMS In NTA 8130 MBUS2 the master returns an addressed acknowledgement to the slave using the address field Link Layer Address originally received from the slave In OMS MBUS3 the master sends a command with it s own address as Link Layer Address and the slave s address as Application Layer Address MBUSS OMS also allows for a one way unidirectional repeater The repeater will re transmit all messages from slaves within range Modules with MBUS3 features set can be configured as a repeater 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 5 of 43 Radiocrafts Snes MBUS Wireless M Bus Embedded Protocol Basic functionality The module offers a buffered packet radio acting as a Wireless M Bus modem The module contains a fully embedded protocol supporting EN13757 4 2005 modes e Stationary mode 5 51 S1 m 52 e Frequent transmit mode T T1 and T2 Frequent receive mode R2 The mode is configurable by the MBUS MODE parameter The required M Bus mode is configured by setting the module in configuration mode and entering appropriate UART commands The following modes are supported S1 S2 mode Set MBUS MODE 0 Set PREAMBLE LENGTH 0 for short preamble or 1 for long preamble The RF channel channel 11 and data rate 32 768 kchip s are set internally in the module according to the S mode and will override any settings in
46. in 590 us trxp bytes received x 590 us char 10 bits at 19 2 kBd 70 us delay per character trxp IDLE 900 us Time from last character is sent on the UART until module is in IDLE mode ready for RXD and RX TRXD CTS 20 us Time from last character is received by the UART including any timeout until CTS is activated trxD TX 960 us Time from last character is received by the UART including any timeout until the module sends the first byte on the air TTX IDLE 960 us Time from last character is sent on the air until module is in IDLE mode ready for RXD and RX toFF IDLE 3 2 ms tRESET IDLE 3 0 ms tsLEEP IDLE 1 3 ms tconFIG PROMPT 60 us Time from 00h CONFIG pin is set low until prompt gt Tc conFic 1 1 ms Delay after channel byte is sent until prompt gt For other volatile memory commands there is no delay but immediate prompt To coNFIG 1 1 ms Delay after new M Bus mode byte is sent until prompt gt For other volatile memory commands there is no delay but immediate prompt Twa 1 55 ms M Delay from stop bit of the command byte to start bit of the command prompt reply See figure 5 for details 24 us all other commands tMEMORY CONFIG 31 ms In this period the internal flash non volatile memory is programmed Do not reset turn the module off or allow any power supply dips in this period as it may cause permanent error in the Flash configuration memory After the last command parameter byte the ho
47. iocrafts AS MBUS User Manual rev 1 40 Page 2 of 43 Radiocrafts Embedded Wireless Solutions M B U 5 Quick Start How do transmit data Send your data to the RXD pin on the module Use the UART format with settings 19200 8 1 N no flow control Up to 128 bytes are buffered in the module The first byte of the message must contain the message length The module will transmit the data when the whole packet is received How do l receive data Any received RF data packet with correct Wireless M Bus format and check sums will be sent on the TXD pin Optionally the meter address first M Bus block is added to the data string The RSSI value received signal strength can optionally be added to the message What about the antenna In most cases a simple quarter wavelength wire or a PCB track will do Connect a piece of wire to the RF pin with length corresponding to the quarter of a wavelength For space limited products contact Radiocrafts and we will recommend the best antenna solution for your application How do l change the M Bus mode RF channel or any other parameter To change configurable parameters send one byte to the module with the value 0x00 or assert the CONFIG pin This will take the module into configuration mode Special commands are then used to access the configuration registers and test modes Exit from configuration mode by sending the X command Parameters can be changed permanently and stored in non volatile
48. irst 0x1B 0x00 0xFF 0x12 18 byte 0 255 U_ID2 Unique ID 0x1C 0x00 0xFF 0x34 52 second byte 0 255 U_ID3 Unique ID third 0x1D 0x00 0xFF 0x56 86 byte 0 255 U_ID4 Unique ID forth 0x1E 0x00 0xFF 0x78 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 25 of 43 Radiocrafts MBUS byte 0 255 120 VER Version Ox1F 0x00 0xFF 0x01 1 0 255 DEV Device 0x20 0x00 0xFF 0x07 7 0 255 Data and configuration interface UART Serial Port UART BAUD RATE Baud rate 0x30 0x00 Not used 0x05 5 BE CAREFUL IF 0x01 2400 CHANGING AS HOST 0x02 4800 MAY LOOSE CONTACT 0x03 9600 WITH MODULE 0x04 14400 Does not take effect until 0x05 19200 module is re booted 0x06 28800 reset 0x07 38400 0x08 57600 0x09 76800 115200 OxOB 230400 UART FLOW CTRL UART flow 0x35 0 None 0x00 0 control 1 CTS only 3 CTS RTS 4 RXTX RS485 DATA_INTERFACE Data interface 0x36 0x00 MBUS 0x00 0 Sets receiver data format packet with ID and First byte is always address 0x01 packet length except Application data when using start byte only 0x02 Reserved 0x03 Application data only with ack 00 3Eh 0x04 Add start stop byte 0x08 Add CRC 0x0C Add start stop byte and CRC FREQ CAL 0x39 Different Found in factory and for each used by the module to module minimise the total frequency tolerance For firmware upgrade
49. ke this Figure 2 UART interface packet transmission RXD pin L is the length not including the length byte itself followed by the application data with the CI byte first CI is the Control Information byte The application data typically contains the application header and data points with VIF and DIF codes The application data can also be SML of DMLS The HEADER and C field and adjusted L value is added to Wireless M Bus packet automatically by the module before transmitting over RF and both can be changed in configuration mode Frame format for receiving data The data frame for the UART TDX pin Output for received Wireless M Bus packets is built like this 10a u i2 mz fu 101 ver per Pus CRC STOP p gt Enable by DATA INTERFACE Enable by KSSI MODE gt L Lenghtof C HEADER CI 4APPL DATA RSSH CRC Enable by DATA INTERFACE Figure 3 UART interface packet reception TXD pin Data in blue and yellow are optional output parts of the UART message and can be enabled in configuration mode by the DATA INTERFACE and RSSI MODE configuration parameters L is the length byte and is always present It does not include itself or the START STOP bytes but will include RSSI and CRC if enabled When setting DATA INTERFACE 1 the received HEADER will not be sent on the UART typically used on a slave However to be able to notify the external application when an Acknowledgement is re
50. latile memory commands there is no delay but immediate prompt To coNFIG 1 1 ms Delay after new M Bus mode byte is sent until prompt gt For other volatile memory commands there is no delay but immediate prompt Twat 1 55 ms B K and M Delay from stop bit of the command byte to start bit of command the prompt reply See figure 5 for details 24 us all other commands TMEMORY CONFIG 31 ms In this period the internal flash non volatile memory is programmed Do not reset turn the module off or allow any power supply dips in this period as it may cause permanent error in the Flash configuration memory After the last command parameter byte the host should wait for the gt prompt before any further action is done to ensure correct re configuration Tcowric IDLE 1 1 ms End of X to IDLE trx 3 6 ms TX time for T1 mode when Length 1 on the UART Preamble sync CRC and MBUS address field added internally Depends on M Bus mode T S R and L 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 33 of 43 Radiocrafts MBUS3 Configuration Commands MBUS A list of commands is shown in the table below Commands must be sent as ASCII characters or their corresponding binary value All arguments must be sent as binary values to the module not as ASCII representation for hex or decimal Auto message A 0x41 Register number 1 64 Sets auto m
51. lt key in the configuration memory Example of UART RXD frames that enable encryption Test packet A No filling byte Slave TX message C 6 L 2D CI 72 Data 78563412AE070107010020042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFA ABBCCDDEEFF Slave TX message C 6 L 25 CI 5A Data 020020042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFF Slave TX message C 6 L 2D CI 5B Data 78563412AE070107030020042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFA ABBCCDDEEFF Test packet B Adding filling bytes Slave TX message C 6 L 1E Cl 72 Data 78563412AE070107040011042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCC Slave TX message C 6 L 17 CI 5A Data 050012042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDD Slave TX message C 6 L 2E CI 5B Data 78563412AE070107060021042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFA ABBCCDDEEFFAA Test packet C Adding filling bytes and un encrypted bytes at the end of the packet Slave TX message C 6 L 22 CI 72 Data 78563412AE070107070011042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCAAAAAAAA Slave TX message C 6 L 1B CI 5A Data 080012 42F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDDAAAAAAAA Slave TX message C 6 L 2B CI 5B Data 78563412AE07010709001A042F2FAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFAABBCCDDEEFFA AAAAAAA Green Number of encrypted bytes including the two 0x2F bytes in the start of the encryption part Read Second block Header un encrypted Purple Encrypted part of UART message Inte
52. mal mode Example To select RF channel 3 send the follow sequence after asserting the CONFIG line and the gt prompt is received Command Hex Response Comment Note Enter 0x00 gt Or assert CONFIG pin De assert CONFIG after gt prompt C 0x43 gt 3 0x03 gt Wait for gt prompt A new command could be issued here X 0x58 none Module returns to IDLE state Note that the CONFIG line must be de asserted after the first gt prompt was received but before the X command 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 15 of 43 Radiocrafts MBUS1 Configuration Memory The table below shows the complete list of configurable parameters stored in non volatile memory These values can be changed using the M command All addresses and arguments must be sent as binary values to the module not as ASCII representation for hex MBUS or decimal Radio configuration RF CHANNEL Default RF 0x00 1 10 0x01 1 See data sheet for channel for R channel frequencies mode only Only used for R mode RF POWER Default RF 0x01 1 5 0x05 5 See data sheet for output output power power levels MBUS_MODE M Bus mode 0x03 0 4 0x01 1 Use G command to 0 5 change value volatile 1 T1 memory only 2 T2 3 Reserved 4 R SLEEP_MODE Sleep mode 0x04 0 Disable Sleep 0x00 0 When enabled the 1 Enable Sleep module enter Sleep mode after transmission RSSI_MODE Append RSSI 0
53. must be sent as binary values to the module not as ASCII representation for hex or decimal Radio configuration RF CHANNEL Default RF 0x00 1 10 0x01 1 See data sheet for channel for R channel frequencies mode only Only used for R mode RF POWER Default RF 0x01 1 5 0x05 5 See data sheet for output output power power levels MBUS_MODE M Bus mode 0x03 0 4 0x01 1 Use G command to 0 S2 change value in volatile 1 T1 memory only 2 T2 3 51 R mode not supported 4 R OMS SLEEP_MODE Sleep mode 0x04 0 Disable Sleep 0x00 0 When enabled the 1 Enable Sleep module enter Sleep mode after TX after transmission or 2 Reserved reception Delay set by 3 Enable Sleep RX TIMEOUT after TX and RX 5 As 1 with If enabled with sleep sleep timeout timeout the module goes 5 As 3 with directly to Sleep after a sleep timeout Reset and to Sleep after TIMEOUT when wakeup from Sleep or exit Config mode RSSI_MODE Append RSSI 0 05 0 Disabled 0x00 0 When enabled the RSSI to received 1 Enabled value is appended to the data received data Radio packet configuration PREAMBLE _ Short of long OxOA 0x00 0 Short 0x00 0 Preamble header LENGTH preamble in S 0x01 1 Long length apply for S mode mode only only TIMEOUT Time before 0x10 lt 1 254 gt 0x7C IF SLEEP_MODE 3 the modem clear 0x01 1 32 ms same timeout is used to buffer without 0x02 2 48 ms a
54. n decryption will only take place when the signature field indicate mode 0x04 or 0x05 If encryption mode 0x00 is used the message will not be encrypted decrypted even if the flags are set 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 21 of 43 Radiocrafts MBUS2 Timing table The table below shows the timing information for the module when changing between different operating states Timing symbol is according to figure 5 and 6 MBUS trx TXD 180 us Time from last byte is received from the air until first character is sent on the UART trxp Min 590 us trxp bytes received x 590 us char 10 bits at 19 2 kBd 70 us delay per character trxD IDLE 900 us Time from last character is sent on the UART until module is in IDLE mode ready for RXD and RX TRXD CTS 20 us Time from last character is received by the UART including any timeout until CTS is activated tRxD TX 960 us Time from last character is received by the UART including any timeout until the module sends the first byte on the air Trx IDLE 960 us Time from last character is sent on the air until module is in IDLE mode ready for RXD and RX toFF IDLE 3 2 ms tRESET IDLE 3 0 ms tsLEEP IDLE 1 3 ms tconFIG PROMPT 60 us Time from 00h CONFIG pin is set low until prompt gt Te conFic 1 1 ms Delay after channel byte is sent until prompt gt For other volatile memory commands there is no delay but
55. o be changed using the G command Using the G command the value is not stored in non volatile memory To do a permanent change use the M command The G command should be used for frequent change of mode to prevent excessive writing to the flash based non volatile memory 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 6 of 43 Radiocrafts The default C field is entered and stored in the modules non volatile memory CONTROL_FIELD The C field can also be changed using the F command Using the F command the value is not stored in non volatile memory To do permanent change use the M command The default Manufacturer ID and unique meter Address is entered and stored in the modules non volatile memory The destination address or module address can also be changed using the T command Using the T command the address is not stored in non volatile memory To do a permanent change use the M command MBUS2 sets the destination address automatically based on the last received message The module has an internal buffer and transmits application data as soon as the whole packet is received based on the packet length first byte of the application frame The module also has a timeout feature that will empty the input buffer in case of false data packets The default timeout is 2 seconds Max total payload is 246 bytes or 255 including the header in the first block Sleep mode can be ent
56. ocrafts Embedded Wireless Solutions M B U S control 1 CTS only 3 CTS RTS 4 RXTX RS485 DATA_INTERFACE Data interface 0x36 0x00 MBUS 0x00 0 Sets receiver data format packet with ID First byte is always and address packet length except 0x01 Application when using start byte data only 0x02 Reserved 0x03 Application data only with ack 00 3Eh 0x04 Add start stop byte 0x08 Add CRC 0x0C Add start stop byte and CRC CONTROL_FIELD C field 0x3B 0x00 0xFF 0x44 68 Use F command to 0 255 change value in volatile memory only PART_NUMBER 0x3C RCxxxx 0x48 MBUS1 HW_REV_NO Ox4A X yz x y and z Any number Ox4D Od 9d FW REV NO Ox4F 0x5 2 y and z number 0d 9d Exit from memory OxFF No argument To exit from command configuration should be sent mode the X command must be sent after gt is received To make permanent changes to default values and other parameters the Memory Configuration command M is used This command should be followed by pairs of byte being the memory address and the new value to be stored at that address In order to exit the Memory Configuration mode the address OxFF must be sent but without any data argument Then wait for the gt prompt while the internal memory is re programmed see Timing Information for typical delay To completely exit from command mode the normal exit command X must be sent Ex
57. on key register combined with an auto message generator for standard messages and its combination with a mailbox with pre generated messages or templates and a given message priority depending on incoming messages are subject to patenting Any infringements of patents and IP rights held by Radiocrafts will be prosecuted to the fullest extent Introduction Network Topology A Wireless M Bus supported metering system normally consists of a number of heat gas water and or electricity meters which reports their meteorological readings to a concentrator The concentrator acts as the master in the system while the meters are slaves The Radiocrafts Wireless M Bus family of modules RC 11xx MBUSx can be configured to have a role as either master or slave The slave contains a unique address and when sending a meter reading this address is added to the wireless message The message from a slave does not contain any master address but the master module within range will receive the message and based on the slave address if the slave is installed and master configured for filtering it will decode the message and send the data on its serial interface TXD pin In two way communication modes the battery operated meter slave will keep the receiver on for a short time During this time slot the master can acknowledge the received message in order to open the communication channel NTA 8130 or send a command OMS and thereby start a commun
58. rnal encryption and not encrypted on UART Black Un encrypted part of message Slave step by step guide to send an encrypted message to a Master 1 Enter configuration mode 2 Send the slave key to the module using the K command and Slave Key as command parameter 3 Enable Encryption using the E command and 0x01 as command parameter 4 Leave configuration mode using the X command 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 20 of 43 Radiocrafts Snes MBUS 5 Send one of the valid test packets above This packet will now be encrypted over the RF link Master step by step guide to receive an encrypted message from a Slave 1 Enter configuration mode 2 Install the Slave to this Master using the B and Address Register as command parameter followed by the slave address Address register is 1 8 2 Send the Master key to module using the K command and Address Register Master Key as command parameters 3 Enable Decryption using the D command and Address Register as command parameter 4 Leave configuration mode using the X command An encrypted packet from the installed slave will now be decrypted before it is provided on the UART TXD Note that you also have the option to use the M command to permanently set the Encryption Decryption flag in the configuration non volatile memory instead of using the D and E commands Encryptio
59. st should wait for the gt prompt before any further action is done to ensure correct re configuration Tcowric IDLE 1 1 ms End of X to IDLE trx 3 6 ms TX time for T1 mode when Length 1 on the UART Preamble sync CRC and MBUS address field added internally 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 13 of 43 Radiocrafts e MBUS MBUS1 Configuration Commands A list of commands is shown in the table below Commands must be sent as ASCII characters or their corresponding binary value All arguments must be sent as binary values to the module not as ASCII representation for hex or decimal Channel C 0x43 0x01 0x0C 1 10 Data is stored in volatile Apply for R mode only memory only C field F 0x46 0x00 0xFF 0 255 Data is stored in volatile memory only M Bus mode 0x47 0x00 0x04 0 4 Data is stored in volatile 0 S memory only 1 T1 2 T2 3 Reserved 4 R Memory M 0x4D Address Data see list of Used to enter memory configuration parameters below configuration menu 0xFF exits memory Parameters changed are configuration stored in non volatile memory Output power P 0x50 0x01 0x05 1 5 Data is stored in volatile memory only Quality Q 0 51 Returns one byte indicating Based on bit errors in Indicator the signal quality preamble and synch word Signal S 0 53 Returns
60. ta transmission if a message is not received The receiver timeout is configured by RX_TIMEOUT The automatic sleep is done after any message transmitted The slave host application is responsible for waking up the module for a re transmission in 2 5 seconds if a communication sequence was started but no reply received from the master 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 30 of 43 Radiocrafts Amedeed reies Somen MBUS If automatic SLEEP after RX and TX is enabled SLEEP MODE 3 the module will automatically go to sleep after data reception and the message is sent to the host over the UART This feature should normally only be used for a Slave In T mode the RX TIMEOUT should be set to 6 In S mode the RX_TIMEOUT should be set to 86 MBUS3 Installation and Binding The module Master can be set in Installation Mode using the I command When the module is in Installation Mode it will accept all Send Installation Request SND IR messages C field is 46h Slaves be bound to Master by registering their addresses the Address Register This is done by using the B Bind command followed by a register number 1 64 and an 8 bytes slave address The Slave address format is the same as used in the Application Layer Address Thus a maximum of 64 meters can be bound to one Master MUC Note the host must know which registers are used and which are free at any time MBUS3 Encryption
61. tems where malfunction can reasonably be expected to result in significant personal injury to the user or as a critical component in any life support device or system whose failure to perform can be reasonably expected to cause the failure of the life support device or system or to affect its safety or effectiveness Radiocrafts AS customers using or selling these products for use in such applications do so at their own risk and agree to fully indemnify Radiocrafts AS for any damages resulting from any improper use or sale 2010 Radiocrafts AS All rights reserved Contact Information Web site www radiocrafts com Address Radiocrafts AS Sandakerveien 64 NO 0484 OSLO NORWAY Tel 47 4000 5195 Fax 47 22 71 29 15 E mails radiocrafts radiocrafts com sales Qradiocrafts com support radiocrafts com 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 43 of 43
62. ter only receives messages from installed registered meters optional Master only receives messages from installed registered meters optional Automatic No must be handled Yes according to Yes according to OMS acknowledge in externally NTA8130 T2 Automatic No No Yes according to OMS message supporting two way acknowledge slaves Standard from Master acknowledge or a predefined message from mailboxes or templates The command set used to configure the MBUS modules are different for each feature set and an overview is found in the appendixes Note that this user manual also is applicable for the RCxxxxTX MBUS This is a TX only hardware and the RX features described in this user manual is not supported Optional custom specific version As an option to the standard feature sets a full wireless M Bus application layer can be integrated in the module based on customer specification In this case all the application layer protocol and timing will be handled internally by the module See Data sheet for details 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 4 of 43 Radiocrafts e LL MBUS Important note on patent pending technology Some of the technical solutions described in this User Manual are based on patent pending technology In particular the methods used in the MBUS3 to meet the T2 timing requirements for a master using an address register a flag register an encrypti
63. turned off by activating the Install button input again The LED output will then stop toggling All pending messages are cleared when entering Installation mode but the module also works as a normal repeater when in Installation mode 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 32 of 43 Radiocrafts MBUS3 Timing table The table below shows the timing information for the module when changing between different operating states Timing symbol is according to figure 5 and 6 MBUS trx TXD 180 us Time from last byte is received from the air until first character is sent on the UART trxp Min 590 us trxp bytes received x 590 us char 10 bits at 19 2 kBd 70 us delay per character trxD IDLE 900 us Time from last character is sent on the UART until module is in IDLE mode ready for RXD and RX TRXD CTS 20 us Time from last character is received by the UART including any timeout until CTS is activated tRxD TX 960 us Time from last character is received by the UART including any timeout until the module sends the first byte on the air Trx IDLE 960 us Time from last character is sent on the air until module is in IDLE mode ready for RXD and RX toFF IDLE 3 2 ms tRESET IDLE 3 0 ms tsLEEP IDLE 1 3 ms tconFIG PROMPT 60 us Time from 00h CONFIG pin is set low until prompt gt Te conFic 1 1 ms Delay after channel byte is sent until prompt gt For other vo
64. umber reservations in configuration memory 1 byte frequency tolerance calibration value in configuration memory SLEEP MODE TIMEOUT and LED CONTROL update Disclaimer Radiocrafts AS believes the information contained herein is correct and accurate at the time of this printing However Radiocrafts AS reserves the right to make changes to this product without notice Radiocrafts AS does not assume any responsibility for the use of the described product neither does it convey any license under its patent rights or the rights of others The latest updates are available at the Radiocrafts website or by contacting Radiocrafts directly As far as possible major changes of product specifications and functionality will be stated in product specific Errata Notes published at the Radiocrafts website Customers are encouraged to check regularly for the most recent updates on products and support tools Trademarks RC232 is a trademark of Radiocrafts AS The RC232 Embedded RF Protocol is used in a range of products from Radiocrafts The protocol handles host communication data buffering error check addressing and broadcasting It supports point to point point to multipoint and peer to peer network topologies All other trademarks registered trademarks and product names are the sole property of their respective owners Life Support Policy This Radiocrafts product is not designed for use in life support appliances devices or other sys
65. uto sleep slaves transmitting if 0x03 3 64 ms Buffer size lt Ox7C 124 2 s Modem transmit without Length byte OxF9 249 4 s timeout when first byte Buffer size length byte Medium access addressing and network management NETWORK ROLE 0x12 0x00 0 0x00 0 Slave Meter 0x01 1 Master Concentr ator 0x10 2 Repeater MAILBOX Auto message 0x16 0x10 Clear Special messages are and mailbox standard SND NR RSP UD and configuration message flag ACK 0x08 Clear mailbox flag 0x04 Use mailbox only for special messages 0x02 Check 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 36 of 43 Radiocrafts MBUS DFC bit before transmission 0x01 Check Accessibility before transmission Manufacturer 0x19 ID first byte 0x00 OxFF 0 255 12 Manufacturer Ox1A ID second byte 0x00 0xFF 0 255 OxAE 174 Unique ID first 0x1B byte 0x00 0xFF 0 255 0x12 18 Unique ID Ox1C second byte 0x00 0xFF 0 255 0x34 52 Unique ID third byte 0x1D 0x00 0xFF 0 255 0x56 86 Unique ID forth byte 0x1E 0x00 0xFF 0 255 0x78 120 Version 0x1F 0x00 0xFF 0 255 0x01 1 Device 0x20 0x00 0xFF 0 255 0x07 7 Data and configuration interface UART Serial Port UART BAUD RATE Baud rate 0x30 0x00 Not used 0x01 2400 0x02 4800 0x03 9600 0x04 14400
66. x05 0 Disabled 0x00 0 When enabled the RSSI to received 1 Enabled value is appended to the data received data Radio packet configuration PREAMBLE_ Short of long OxOA 0x00 0 Short 0x00 0 Preamble header LENGTH preamble in 5 0x01 1 Long length apply for S mode mode only only Medium acce ss addressing and network management NETWORK ROLE 0x12 0x00 0 0x00 1 Slave Meter 0x01 1 Master Concentr ator M_ID1 Manufacturer 0x19 0x00 0xFF 0x0C 12 ID first byte 0 255 M_ID2 Manufacturer 0x00 0xFF OxAE ID second byte 0 255 174 U_ID1 Unique ID first 0x1B 0x00 0xFF 0x12 18 byte 0 255 U_ID2 Unique ID 0x1C 0x00 0xFF 0x34 52 second byte 0 255 U_ID3 Unique ID third 0x1D 0x00 0xFF 0x56 86 byte 0 255 U 1D4 Unique ID forth OX1E 0x00 0xFF 0x78 byte 0 255 120 VER Version Ox1F 0x00 0xFF 0x01 1 0 255 DEV Device 0x20 0x00 0xFF 0x07 7 0 255 Data and configuration interface UART Serial Port UART BAUD RATE Baud rate 0x30 0x00 Not used 0x05 5 BE CAREFUL IF 0x01 2400 CHANGING AS HOST 0x02 4800 MAY LOOSE CONTACT 0x03 9600 WITH MODULE 0x04 14400 Does not take effect until 0x05 19200 module is re booted 0x06 28800 reset 0x07 38400 0x08 57600 0x09 76800 Ox0A 115200 0x0B 230400 UART FLOW CTRL UART flow 0x35 0 None 0x00 0 2010 Radiocrafts AS MBUS User Manual rev 1 40 Page 16 of 43 Radi

MBUS - Radiocrafts AS

Contents

Download Pdf Manuals

Related Search

Related Contents