Amber Wireless AMB8426-M User manual

Manual AMB8426-M / AMB8626-M
Version 2.4
SW-V2.1
AMBER wireless GmbH
Albin-Köbis-Straße 18
51147 Köln / Germany
Tel. [phone]
E-Mail [e-mail]
Internet http://www.amber-wireless.de

AMB8426-M_8626-M_MA_EN_V2_4 Page 2 of 48 Released: Nov.2013
Table of Contents
1 Summary................................................................................................................................5
2 Communication with the Customer Application .................................................................5
2.1 Transparent buffered Data Transfer..................................................................................5
2.1.1 Wireless Transmission of Data...................................................................................5
2.1.2 Wireless Reception of Data........................................................................................6
2.2 Command Mode ...............................................................................................................7
2.2.1 Command overview....................................................................................................7
3 Format of the wM-Bus Radio Telegram ...............................................................................8
4 Technical Parameters ...........................................................................................................8
5 Serial User Interface..............................................................................................................8
5.1 UART................................................................................................................................8
5.1.1 Supported Data Rates................................................................................................8
5.1.2 Supported Data Formats ............................................................................................9
5.2 SPI Interface.....................................................................................................................9
6 Wireless M-Bus modes of operation....................................................................................9
7 The Command Interface......................................................................................................10
7.1 Data Transfer in the Command Mode.............................................................................10
7.1.1 CMD_DATA_REQ ......................................................................................................10
7.1.2 CMD_DATARETRY_REQ............................................................................................11
7.1.3 CMD_DATA_IND ......................................................................................................11
7.2 CMD_SET_MODE_REQ ................................................................................................11
7.3 CMD_RESET_REQ........................................................................................................12
7.4 CMD_SET_CHANNEL_REQ..........................................................................................12
7.5 CMD_SET_REQ.............................................................................................................12
7.6 CMD_GET_REQ.............................................................................................................13
7.7 CMD_SERIALNO_REQ..................................................................................................13
7.8 CMD_FWV_REQ............................................................................................................14
7.9 CMD_RSSI_REQ............................................................................................................14
7.10 CMD_SETUARTSPEED_REQ .....................................................................................15
7.11 CMD_FACTORYRESET_REQ.....................................................................................16
7.12 Bidirectional communication..........................................................................................16
7.12.1 CMD_DATA_PRELOAD_REQ...............................................................................16
7.12.2 CMD_DATA_CLR_PRELOAD_REQ......................................................................17
7.13 Encryption and decryption OK.......................................................................................17
7.13.1 CMD_SET_AES_KEY_REQ ..................................................................................17
7.13.2 CMD_CLR_AES_KEY_REQ ..................................................................................18
7.13.3 CMD_GET_AES_DEV_REQ..................................................................................18
8 User Parameters..................................................................................................................19
8.1 UART_CTL0...................................................................................................................21
8.2 UART_CTL1...................................................................................................................21
8.3 UART_BR0.....................................................................................................................21
8.4 UART_BR1.....................................................................................................................21
8.5 UART_MCTL..................................................................................................................21
8.6 UART_CMD_Out_Enable...............................................................................................21
8.7 UART_DIDelay...............................................................................................................21
8.8 APP_MAXPacketLength.................................................................................................21
8.9 APP_AES_Enable ..........................................................................................................22

AMB8426-M_8626-M_MA_EN_V2_4 Page 3 of 48 Released: Nov.2013
8.10 APP_WOR_PeriodH.....................................................................................................22
8.11 APP_WOR_PeriodL......................................................................................................22
8.12 APP_WOR_MultiplierH.................................................................................................22
8.13 APP_WOR_MultiplierL..................................................................................................22
8.14 APP_WOR_RX_Time...................................................................................................22
8.15 MBUS_Coding..............................................................................................................23
8.16 MBUS_PreambleLengthH.............................................................................................23
8.17 MBUS_PreambleLengthL .............................................................................................23
8.18 MBUS_Synch ...............................................................................................................23
8.19 MBUS_RXTimeout........................................................................................................24
8.20 MBUS_FrameFormat....................................................................................................24
8.21 MBUS_Bl_ADD_Disable...............................................................................................24
8.22 MBUS_Bl_Control.........................................................................................................25
8.23 MBUS_Bl_ManID1........................................................................................................25
8.24 MBUS_Bl_ManID2........................................................................................................25
8.25 MBUS_Bl_IDNr1...........................................................................................................25
8.26 MBUS_Bl_IDNr2...........................................................................................................25
8.27 MBUS_Bl_IDNr3...........................................................................................................25
8.28 MBUS_Bl_IDNr4...........................................................................................................25
8.29 MBUS_Bl_Version........................................................................................................25
8.30 MBUS_Bl_DevType......................................................................................................25
8.31 RF_Channel..................................................................................................................26
8.32 RF_Power.....................................................................................................................26
8.33 RF_DataRate................................................................................................................27
8.34 RF_AutoSleep ..............................................................................................................27
8.35 RSSI_Enable................................................................................................................28
8.36 Mode_Preselect............................................................................................................28
8.37 Net_Mode.....................................................................................................................30
8.38 Config_CRC_Disable....................................................................................................30
8.39 CFG-Flags....................................................................................................................30
9 Preloading of Telegrams.....................................................................................................32
10 Encryption with AES-128..................................................................................................34
10.1 Incoming RF telegrams.................................................................................................34
10.2 Outgoing RF telegrams.................................................................................................34
11 Toggling the Operating Mode via Pin...............................................................................35
12 Taking into operation........................................................................................................36
12.1 Minimal Configuration ...................................................................................................36
12.2 Transfer of Large Amounts of Data...............................................................................36
12.3 Using the Low-Power Functionality...............................................................................37
13 Hardware integration.........................................................................................................38
13.1 Footprint .......................................................................................................................38
13.2 Tips for Schematic and Layout......................................................................................39
13.3 Antenna connection......................................................................................................39
13.4 Recommendations for mechanical manufacturing.........................................................41
14 Factory-reset......................................................................................................................43
14.1 Reset by command.......................................................................................................43
14.2 Reset via pin-configuration............................................................................................43
14.3 Reset by UART-Sequence............................................................................................43
15 Firmware Update ...............................................................................................................44
16 References.........................................................................................................................44

AMB8426-M_8626-M_MA_EN_V2_4 Page 4 of 48 Released: Nov.2013
17 Regulatory compliance information.................................................................................45
17.1 Important notice............................................................................................................45
17.2 Declaration of Conformity..............................................................................................46
18 Important notes.................................................................................................................48
18.1 Disclaimer of liability .....................................................................................................48
18.2 Trademarks...................................................................................................................48
18.3 Limitation of use............................................................................................................48
Abbreviations
CS
Checksum
PS
UI
Pin select
User interface
Operating mode selection via pins
Serial interface to the host

AMB8426-M_8626-M_MA_EN_V2_4 Page 5 of 48 Released: Nov.2013
1 Summary
The wireless M-bus (wM-Bus) radio module AMB8426-M / AMB8626-M was designed as a
subcomponent group for the wireless reading of meters. It complies with the requirements of
EN13757-4:2011 (wireless M-bus; see [1]) and can be used where ever radio communication is
required.
The following operating modes are supported:
S1 / S1-m / S2
T1 / T2 (meter / other)
R2
C1 / C2 (meter / other)
T2 + C2 (other) combined
A serial interface (UART, optionally SPI) of which the data rate and format can be adjusted, is
available for the communication with the host system.
All transfer parameters listed in the standard EN 13757-4 (coding methods, chip rate, carrier
frequency, preamble length, etc.) can be adjusted flexibly via the user interface.
The module is suitable for use in a battery operated meter, but can also be used in a repeater or
a concentrator.
2 Communication with the Customer Application
Via the serial user interface both the transparent buffered data transfer as well as the device
configuration takes place in the so called command mode.
2.1 Transparent buffered Data Transfer
2.1.1 Wireless Transmission of Data
In this mode the user data to be transmitted is sent to the radio module via the serial interface
and is initially buffered.
The maximum number of user data bytes is selectable
APP_MAXPacketLengrh.
A ‘Length byte’must be placed in front of the actual payload data (see Figure 1). The length
255 (0xFF) is not allowed. The minimum length of user data is 9 bytes.
Figure 1: Telegram format of serial interface, Block 1 is added by the module
After all data has been received, the radio transmission takes place according to the configured
wM-Bus mode of operation (see chapter 6).

AMB8426-M_8626-M_MA_EN_V2_4 Page 6 of 48 Released: Nov.2013
Optionally the AMB8426-M can adopt the content of the first block (C-field, M-field, A-field) from
the non-volatile memory and insert it into the radio telegram, otherwise the format according to
Figure 2 is to be used (factory default; also see parameter MBUS_Bl_ADD_Disable)
Figure 2: Reception of data via serial interface, Block 1 inserted by host
Figure 3: Content of Block 1
2.1.2 Wireless Reception of Data
The output of data also takes place with the length information as preamble.
Figure 4: Telegram format, serial interface, Block 1 ignored by module
Figure 5: Telegram format, serial interface, Block 1 filtered by module
Additionally a measurement for the connection quality can be made available in the form of a
field strength value (see RSSI_Enable).
Figure 6: Telegram format, serial interface, RSSI activated

AMB8426-M_8626-M_MA_EN_V2_4 Page 7 of 48 Released: Nov.2013
2.2 Command Mode
In this operating mode, the communication with the module is achieved by using predefined
commands. For example, these commands can be used to set and read operating parameters
and to execute special functions (see chapter 7).
Also transmission and receiving of wM-Bus data is possible in this mode.
In this case, contrary to the transparent mode (each telegram starts with a length byte), the
telegram has to be preceded by a start byte 0xFF. This is followed by the command, the length
and the payload.
The last byte transmitted is the checksum (XOR of all preceding bytes including the start byte).
The evaluation of the checksum can also be deactivated (see Config_CRC_Disable).
Figure 7: Telegram format of serial interface in the command mode
2.2.1 Command overview
Each command of Type „REQ“ (Request) is followed by a confirm from the module of
type „CNF“ (Confirm). Thus the respective command byte is complimented by the bit
0x80 and returned by the module together with the respective data or status
information. For example in this way the Request „0x0D“ becomes a Confirm „0x8D“
and „0x11“ becomes „0x91“.
The following table provides an overview of the valid commands.
Command
Value
[hex]
Description
CMD_DATA_REQ
7.1.1
0x00
Transmission of wM-Bus data
CMD_DATARETRY_REQ
7.1.2
0x02
Resend data previously sent by the module
CMD_DATA_IND
7.1.3
0x03
Output of received Data
CMD_SET_MODE_REQ
7.2
0x04
Temporary change of the wM-Bus mode of
operation (in volatile memory)
CMD_RESET_REQ
7.3
0x05
Software reset
CMD_SET_CHANNEL_REQ
7.4
0x06
Select channel
CMD_SET_REQ
7.5
0x09
Write parameters of the non-volatile memory
CMD_GET_REQ
7.6
0x0A
Read parameters from the non-volatile memory
CMD_SERIALNO_REQ
7.7
0x0B
Read serial number
CMD_FWV_REQ
7.8
0x0C
Read firmware version
CMD_RSSI_REQ
7.9
0x0D
Read current RSSI value
Reserved
0x0E

AMB8426-M_8626-M_MA_EN_V2_4 Page 8 of 48 Released: Nov.2013
Command
Value
[hex]
Description
CMD_SETUARTSPEED_REQ
7.10
0x10
Select transfer speed of the user interface
CMD_FACTORYRESET_REQ
7.11
0x11
Reset module to factory settings
Reserved
0x20
Reserved
0x21
CMD_DATA_PRELOAD_REQ
0x30
Load telegram for bi-directional operation
CMD_DATA_CLR_PRELOAD_REQ
0x31
Delete preloaded telegram
CMD_SET_AES_KEY_REQ
0x50
AES-Key registration
CMD_CLR_AES_KEY_REQ
0x51
Delete AES-Key
CMD_GET_AES_DEV_REQ
0x52
Read registered AES-Devices
Table 1: Overview of the commands
3 Format of the wM-Bus Radio Telegram
The module takes over the creation of the block-wise check sums as required by [1]
Respective to the selected frame format (see MBUS_FrameFormat) these are added (transmit
mode) or tested and removed (Receive mode).
If during reception a faulty checksum is recognised the telegram is discarded.
Figure 8: Radio telegram with checksum frame format A
Figure 9: Radio telegram with checksum frame format B
Similarly the module takes over the coding of the data dependant of the mode of operation as
required in [1]. A list of possible coding can be found in MBUS_Coding
4 Technical Parameters
For technical data concerning supply voltage, current consumption, dimensions etc., please
refer to the respective data sheet [3].
5 Serial User Interface
5.1 UART
5.1.1 Supported Data Rates
The data rate can be set by using the command CMD_SETUARTSPEED_REQ or by directly
configuring the respective parameters in the module's non-volatile memory (see UART_BR0,
UART_BR1, and UART_MCTL).

AMB8426-M_8626-M_MA_EN_V2_4 Page 9 of 48 Released: Nov.2013
For the configuration of the data rate via the registers UART_BR0, UART_BR1 and
UART_MCTL the PC-program „ACC“ should be used. This, besides the standard baud
rates, also provides a dialog for the calculation of arbitrary baud rates.
The default baud rate of the module is 9600 baud.
The output of characters on the serial interface takes place with secondary priority. For this
reason, short interruptions may occur between the output of individual characters (e.g., in the
event of an interrupt request).
5.1.2 Supported Data Formats
The following data formats are supported:
8 bits
No, even, or odd parity
1 or 2 stop bits
In the ACC program the following data formats can be selected via drop-down menu:
8n1, 8o1, 8e1, 8n2, 8o2, 8e2.
Also in this case the data format can be set by directly configuring the respective
microprocessor registers. (see UART_CTL0)
The default data format is 8 data bits, no parity, 1 stop bit ("8n1").
5.2 SPI Interface
As an alternative to the UART interface, the module also offers an SPI interface (separate
firmware; in preparation).
6 Wireless M-Bus modes of operation
The module allows the free configuration of the wM-Bus modes of operation as described in the
Norm [1] as well as the relating parameters (channel, chip rate, preamble length, coding etc.)
Hereby it is possible to refer to either a number of „presets“ (standard settings) or with the
selection of the respective configuration a flexible selection of the above mentioned parameters
can be made
The wM-Bus mode of operation is predefined by the parameter Mode_Preselect and my during
runtime be modified by the command CMD_SET_MODE_REQ.
If the parameter Mode_Preselect is set to the value 0x0F the mode of operation can also be
changed via external connection (see chapter 11).
An overview of the available modes of operation with the configuration of the individual
parameters can be found in Table 17.
The following table displays the general relationship between the send and receive modes in
the wireless M-Bus as well as the respective settings for the parameter Mode_Preselect

AMB8426-M_8626-M_MA_EN_V2_4 Page 10 of 48 Released: Nov.2013
Transmit Mode
Mode
_Preselect
Suitable Receive Mode
Mode
_Preselect
User defined
Mode
0x00
Dependant of individual parameters
S1
0x01
S2
0x03
S1-m
0x02
S2
0x03
S2
0x03
S2
0x03
Reserved
0x04
T1-Meter
0x05
T2-Other
T2-/C2- Other
0x08
0x09
T1- Other
0x06
S2
T2-Meter (preferred)
0x03
0x07
T2-Meter
0x07
T2- Other
T2-/C2- Other
0x08
0x09
T2- Other
0x08
S2
T2-Meter (preferred)
0x03
0x07
T2-/C2- Other
0x09
Dependant on the previously received mode of
operation
R2-Meter
0x0A
R2- Other
0x0B
R2- Other
0x0B
R2-Meter
0x0A
C1-Meter
0x0C
C2- Other
T2-/C2- Other
0x0E
0x09
C2-Meter
0x0D
C2- Other
T2-/C2- Other
0x0E
0x09
C2- Other
0x0E
C2-Meter
0x0D
„Pin-Select“
0x0F
Dependant on the selected mode of operation
Table 2 Compatible Transmit and Receive Modes
7 The Command Interface
7.1 Data Transfer in the Command Mode
7.1.1 CMD_DATA_REQ
This rf transmission in the command mode serves to do simple data transfer similar to the
transparent mode. Only the start byte, the command and the check sum must be added (with or
without block 1. See chapter 2.1 as well as MBUS_Bl_ADD_Disable).
Format:
0xFF 0x00 < Length byte >< User data >< CS >.
or 0xFF 0x00 < Length byte >< block1>< User data >< CS >.
Return:
0xFF 0x80 0x01 < status > < CS >
Status:
0x00: data transmitted.
0x01: faulty telegram length.

AMB8426-M_8626-M_MA_EN_V2_4 Page 11 of 48 Released: Nov.2013
7.1.2 CMD_DATARETRY_REQ
This command relaunches the transmission of the previously submitted data to the module. The
data thus does not need to be re-sent via the serial interface.
The buffered data is lost as soon as new data is sent via UART or data is being received via
wireless transmission.
Format:
0xFF 0x02 0x00 0xFD
Return:
0xFF 0x82 0x01 < status > < CS >
Status:
0x00: data sent
0x01: no valid data in memory
7.1.3 CMD_DATA_IND
To receive rf data in the command format, the parameter
UART_CMD_Out_Enable has to be set accordingly!
This telegram indicates the reception of data bytes and represents the counterpart to the
command CMD_DATA_REQ.
The output is similar as in the transparent mode, only the start byte, the command and the
check sum must be added (with or without block 1, see section 2.1 as well as
MBUS_Bl_ADD_Disable.)
In addition the output of the RSSI value can be activated (see RSSI_Enable)
Format:
0xFF 0x03 < Length byte >< User data >< CS > or
0xFF 0x03 < Length byte >< C-field >< User data >< CS >.
7.2 CMD_SET_MODE_REQ
This command changes the wM-Bus mode in the volatile memory of the module, and over-
writes the parameter laden from non-volatile memory during start-up.
Mode_Preselect only temporary (until next start-up).
This command is to be used when the mode is changed. Table 17 lists the supported modes.
Format:
0xFF 0x04 0x01 < Mode > <CS>
Return:
0xFF 0x84 0x01 < Status > <CS>
Status:
0x00: success

AMB8426-M_8626-M_MA_EN_V2_4 Page 12 of 48 Released: Nov.2013
7.3 CMD_RESET_REQ
This command triggers a software reset of the module. The reset is performed after the
acknowledge has been issued.
Format:
0xFF 0x05 0x00 0xFA
Return:
0xFF 0x85 0x01 < status > < CS >
Status:0x00: success
7.4 CMD_SET_CHANNEL_REQ
This command is used to toggle the wireless channel in the non-volatile memory. An overview
of the channels is displayed in 0.
Format:
0xFF 0x06 0x01 < 1-byte channel > < CS >
Example (selection of channel 11):
0xFF 0x06 0x01 0x0B 0xF3
Return:
0xFF 0x86 0x01 < new channel > < CS >
Return for above example:
0xFF 0x86 0x01 0x0B 0x73
7.5 CMD_SET_REQ
This command enables the direct manipulation of the parameters in the non-volatile memory of
the module. The respective parameters are accessed via the memory position described in
Table 4.
Individual or multiple consecutive parameters in the memory can be modified concurrently.
The validity of the specified parameters is not verified. Incorrect values can result in
device malfunction!
To make sure the changed parameter(s) are adopted a reset shall be applied after a
CMD_SET_REQ.
To save the parameters in the flash memory of the module, the particular memory
segment must first be flushed entirely and then restored from the RAM. If a reset
occurs during this procedure (e.g., due to supply voltage fluctuations), the entire
memory area may be destroyed. In this case, the module may no longer be operable,
(in this event refer to chapter and ). Recommendation: First, verify the configuration of
the module with CMD_GET_REQ; and only write if necessary.

AMB8426-M_8626-M_MA_EN_V2_4 Page 13 of 48 Released: Nov.2013
Format:
0xFF 0x09 < nr. of bytes + 2 > < address > < nr. of bytes > < parameter > < CS >
Return:
0xFF 0x89 0x01 < status > < CS >
Status:0x00: success
0x01: verification failed
0x02: invalid memory position or invalid number of bytes to be written
(write access to unauthorised location)
Example 1:
Change adding of block 1 (MBUS_Bl_ADD_Disable; according to Table 4, memory
position 0x30):
0xFF 0x09 0x03 0x30 0x01 < parameter value > < CS >
Example 2:
Setting the 3 registers for the baud rate configuration (UART_MCTL, UART_BR0, and
UART_BR1). According to Table 4, UART_BR0 has the memory position 0x02h:
0xFF 0x09 0x05 0x02 0x03 < UART_BR0 > < UART_BR1 > < UART_MCTL > < CS >
7.6 CMD_GET_REQ
This command can be used to query individual or multiple non-volatile user parameters (see
table 4). The requested number of bytes from the specified memory position are returned.
Individual or multiple consecutive parameters in the memory can be queried concurrently.
Format:
0xFF 0x0A 0x02 < address > < number of bytes > < CS >
Example (query of all parameters):
0xFF 0x0A 0x02 0x00 0x80 0x77
Return:
0xFF 0x8A < number of bytes + 2 [0x82]> < memory position[0x00] > < number of
bytes[0x80] > < parameter > < CS >
The read access to the memory area beyond the parameters documented in Table 4 is
inhibited. The memory position and the number of bytes are limited accordingly.
7.7 CMD_SERIALNO_REQ
This command can be used to query the individual serial number of the module.
Format:
0xFF 0x0B 0x00 0xF4
Return:
0xFF 0x8B 0x04 < 4-byte serial number > < CS >

AMB8426-M_8626-M_MA_EN_V2_4 Page 14 of 48 Released: Nov.2013
The most significant byte is returned first (MSB first); this byte identifies the product ("product
ID").
7.8 CMD_FWV_REQ
This command serves to requests the firmware version. Herewith the major, minor und patch –
position of the FW-Version is returned.
Format:
0xFF 0x0C 0x00 0xF3
Return:
0xFF 0x8C 0x03 < 3 Byte FW-Version > <CS>
Example (Version 2.0.6):
0xFF 0x8C 0x03 0x02 0x00 2x06 0x74
7.9 CMD_RSSI_REQ
This command returns the current RX level as determined by the transceiver IC in the form of a
signed two's complement value.
Format:
0xFF 0x0D 0x00 0xF2
Return:
0xFF 0x8D 0x01 < RX level > < CS >
The obtained value (RX level RSSIdBm in dBm) is comprised as follows:
1. Conversion of the hexadecimal value to a decimal RSSIdec value
2. If RSSIdec 128: RSSIdBm = (RSSIdec –256) / 2 - 74
3. Otherwise (RSSIdec < 128): RSSIdBm = RSSIdec / 2 - 74
The relation between the calculated value and the physical RX level in dBm is not linear across
the entire operating range and is displayed in Figure 10.

AMB8426-M_8626-M_MA_EN_V2_4 Page 15 of 48 Released: Nov.2013
Figure 10
Relation between the RX level and the RSSI value read from the AMB8426 (from [2])
7.10 CMD_SETUARTSPEED_REQ
This command changes the parameters of the serial user interface (UART_CTL0, UART_CTL1,
UART_BR0, UART_BR1, UART_MCTL)to preset values for fixed transfer rates. The index of the
transfer rate is listed in Table 3.
The change of the baud rate only takes effect after a restart of the module!
Index
Transfer rate [baud]
0x00
1200
0x01
2400
0x02
4800
0x03
9600
0x04
19200
0x05
38400
0x06
56000
0x07
115200
Table 3: Preconfigured transfer rate of the serial interface

AMB8426-M_8626-M_MA_EN_V2_4 Page 16 of 48 Released: Nov.2013
Format:
0xFF 0x10 0x00 < index > < CS >
Return:
0xFF 0x90 0x01 < status > < CS >
Status:
0x00: success
0x01: verification in flash failed
0x02: invalid index
7.11 CMD_FACTORYRESET_REQ
This command resets all parameters to their factory settings:
Format:
0xFF 0x11 0x00 0xEE
Return:
0xFF 0x90 0x01 < status > < CS >
Status:
0x00: success
After a factory reset the settings for the user interface are reset. These settings are only
activated after a restart of the module! Registered AES-Keys with their relating IDs are
retained.
7.12 Bidirectional communication
For this functionality also see chapter 9.
7.12.1 CMD_DATA_PRELOAD_REQ
With this command a telegram can be pre-loaded into the module.
This command generates two acknowledges:
1. Directly after the command has been sent to the module via serial interface
2. As soon as the pre-loaded telegram has been transmitted via radio, or from point of view
of the host at any arbitrary point of time.
Format:
0xFF 0x30 < number of bytes > < data with ALA-address of the counter > < CS >
Return:
0xFF 0xB0 0x01 < status > < CS >
Status:
0x00: success
0x01: telegram has been transmitted
0x02: no more memory available to preload a telegram

AMB8426-M_8626-M_MA_EN_V2_4 Page 17 of 48 Released: Nov.2013
7.12.2 CMD_DATA_CLR_PRELOAD_REQ
With this command the preloaded telegram can be rejected.
Format:
0xFF 0x31 0x00 0xCE
Return:
0xFF 0xB1 0x01 < Status > < CS >
Status:
0x00: success
0x01: no telegram had been preloaded
7.13 Encryption and decryption OK
For this functionality also see chapter 10.
7.13.1 CMD_SET_AES_KEY_REQ
Up to 64 AES-Keys together with their addresses can be registered in the module.
With this command an AES-key and a device address can be stored in the non-volatile memory.
The AES-key is then used for encryption and decryption. The address of a device is transmitted
exactly as in block 1 (see Figure 3, without C-field) of a wM-Bus telegram. The AES-key is
transmitted LSB first.
Format:
0xFF 0x50 0x18 < address of the device > < 16 byte AES-key > < CS >
Address:
Man ID 1
(1 Byte) Man ID 2 (1 Byte) ID 1 (1 Byte) ID 2 (1 Byte) ID 3 (1 Byte) ID 4 (1 Byte) Version (1 Byte)
Geräte-
typ
(1 Byte)
AES-key:
AES-Key
LSB AES-Key LSB+1 ... AES-Key MSB -1 AES-Key MSB
Return:
0xFF 0xD0 0x01 < status > < CS >
Status:
0x00: success
0x01: verification in memory failed
0x02: no more memory available
Example:
Manufacturer: AMB (0x05A2)

AMB8426-M_8626-M_MA_EN_V2_4 Page 18 of 48 Released: Nov.2013
ID: 0x12345678
Version: 0x00
Device type: Water (0x03)
Key (LSB first):
0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E
0x0F
Telegram:
0xFF 0x50 0x18 0xA2 0x05 0x78 0x56 0x34 0x12 0x00 0x03 0x00 0x01 0x02 0x03 0x04
0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x1B
7.13.2 CMD_CLR_AES_KEY_REQ
This command can be used to delete an AES-key.
Format:
0xFF 0x51 0x08 <Address of device> <CS>
Return:
0xFF 0xD1 0x01 <Status> <CS>
Status:
0x00: success
0x01: verification in memory failed
0x02: the meter could not be found in the list
7.13.3 CMD_GET_AES_DEV_REQ
With this command the addresses of all registered devices can be read. The addresses are
saved in 4 banks (0x00, 0x01, 0x02, 0x03). These banks have to be called up one after the
other.
Format:
0xFF 0x52 0x01 < Bank > < CS >
Return:
0xFF 0xD2 0x80 < registered addresses > < CS >
Example:
Prompt of bank 0:
0xFF 0x52 0x01 0x00 0xAC
Answer from the registration in chapter 7.13.1:
0xFF 0xD2 0x80 0xA2 0x05 0x78 0x56 0x34 0x12 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x01

AMB8426-M_8626-M_MA_EN_V2_4 Page 19 of 48 Released: Nov.2013
8 User Parameters
The non-volatile parameters listed in the following table can be modified by CMD_SET_REQ,
read by CMD_GET_REQ as well as also modified by the Windows software "ACC".
These parameters are permanently stored in the flash memory of the module.
Parameter
Description
Adr.
Permissible
values
Default
UART_CTL0
Control register for
UART data format
0x00
See Table 5
UART_CTL1
Control register for
UART
0x01
0x80
UART_BR0
Prescaler for setting the
baud rate (LSB)
0x02
Compute with
ACC
UART_BR1
Prescaler for setting the
baud rate (MSB)
0x03
Compute with
ACC
UART_MCTL
Modulation control
register UART
0x04
Compute with
ACC
UART_CMD_Out_Enable
Output of received
frames in CMD format
0x05
0x00, 0x01
0x00
UART_DIDelay
Configurable output
delay
0x06
0x0000 –0xFFFF
0x0000
Reserved
0x08
0xFF
Reserved
0x09
0xFF
APP_MAXPacketLength
Maximum number of
bytes to send/receive
0x0A
0x0A –0xFF
0x80
APP_AES_Enable
Enable encryption
0x0B
See Table 6
0x00
Reserved
0x0C
0x00 –0xFF
0x00
Reserved
…
0xFF
Reserved
0x1B
0x00 –0xFF
0x00
APP_WOR_PeriodH
Period length in ms -
high byte
0x1C
0x00 –0xFF
0x00
APP_WOR_PeriodL
Period length in ms -
low byte
0x1D
0x00 –0xFF
0x32
APP_WOR_MultiplierH
Multiplier of the period
length - high byte
0x1E
0x00 –0xFF
0x00
APP_WOR_MultiplierL
Multiplier of the period
length - low byte
0x1F
0x00 –0xFF
0x02
APP_WOR_RX_Time
WOR-time in ms during
which the module
remains in RX mode
0x20
0x00 –0xFF
0x14
Reserved
0x21
0xFF
Reserved
…
0xFF
Reserved
0x26
0xFF
MBUS_Coding
Coding method
0x27
See Table 7
0x01
MBUS_PreambleLengthH
Header length in bytes
(high byte)
0x28
0x00 –0xFF
0x00
MBUS_PreambleLengthL
Header length in bytes
(low byte)
0x29
0x00 –0xFF
0x04
MBUS_Synch
Synchronisation
character
0x2A
See Table 8
0x00
MBUS_RXTimeout
Time in ms that the
0x2B
0x00 –0xFF
0x00

AMB8426-M_8626-M_MA_EN_V2_4 Page 20 of 48 Released: Nov.2013
Parameter
Description
Adr.
Permissible
values
Default
module remains in the
RX mode after
transmitting data
MBUS_FrameFormat
Frame Format
0x2C
see Table 10
0x00
Reserved
0x2D
0xFF
Reserved
0x2E
0xFF
Reserved
0x2F
…
0xFF
MBUS_Bl_ADD_Disable
Disabling adding of
block 1
0x30
See Table 11
0x01
MBUS_Bl_Control
C-field of block 1
0x31
0x00 –0xFF
0x44
MBUS_Bl_ManID1
M-field of block 1
0x32
0x00 –0xFF
0x00
MBUS_Bl_ManID2
M-field of block 1
0x33
0x00 –0xFF
0x00
MBUS_Bl_IDNr1
A-field of block 1
0x34
0x00 –0xFF
0x00
MBUS_Bl_IDNr2
A-field of block 1
0x35
0x00 –0xFF
0x00
MBUS_Bl_IDNr3
A-field of block 1
0x36
0x00 –0xFF
0x00
MBUS_Bl_IDNr4
A-field of block 1
0x37
0x00 –0xFF
0x00
MBUS_Bl_Version
A-field of block 1
0x38
0x00 –0xFF
0x00
MBUS_Bl_DevType
A-field of block 1
0x39
0x00 –0xFF
0x00
Reserved
0x3A
0xFF
Reserved
0x3B
0xFF
RF_Channel
Radio channel
0x3C
See Table 12
0x0B
RF_Power
Transmission power
0x3D
See Table 13
0x05
RF_DataRate
Chip rate
0x3E
See Table 14
0x01
RF_AutoSleep
Sleep mode
0x3F
See Table 15
0x00
Reserved
0x40
0xFF
Reserved
…
0xFF
Reserved
0x44
0xFF
RSSI_Enable
Enable RSSI value
output
0x45
See Table 16
0x00
Mode_Preselect
Default settings for M-
bus operating modes
0x46
See Table 17
0x03
Net_Mode
Modem, concentrator,
or repeater mode
0x47
0x00
0x00
Config_CRC_Disable
Take checksum into
consideration for the
configuration mode
0x48
See Table 18
0x00
Reserved
0x49
0xFF
Reserved
…
0xFF
Reserved
0x4F
0xFF
CFG-Flags
Configuration flags
0x50
See Table 19
0x0000
Reserved
0x51
0xFF
Reserved
…
0xFF
Reserved
0x78
0xFF
Table 4: Non-volatile user parameters