Radiocrafts MBUS Series User manual

MBUS User Manual
RC11xx-MBUS3
RC1701HP-MBUS4
Important note:
This User Manual contains patented technology. See page 6 for more
information.

Page 1of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
Table of Contents
1INTRODUCTION..............................................................................................................................4
1.1 QUICK START............................................................................................................................4
1.2 DIFFERENCIES BETWEEN RC11XX AND RC17XX SERIES .............................................................5
1.3 OPTIONAL CUSTOM SPECIFIC VERSION........................................................................................5
1.4 IMPORTANT NOTE ON PATENTED TECHNOLOGY............................................................................6
2BASIC FUNCTIONALITY................................................................................................................7
2.1 UART INTERFACE –MODULE CONFIGURATION...........................................................................8
2.2 UART INTERFACE –CONFIGURATION COMMANDS.......................................................................9
2.3 UART INTERFACE –SEND AND RECEIVE MESSAGES .................................................................10
2.4 NETWORK TOPOLOGY..............................................................................................................12
2.5 MBUS BASIC FUNCTIONALITY..................................................................................................13
3TIMING...........................................................................................................................................16
3.1 STATES OVERVIEW ..................................................................................................................16
3.2 TIMING –FROM RESET AND SLEEP TO IDLE..........................................................................17
3.3 TIMING –IN AND OUT OF CONFIG MODE ..................................................................................17
3.4 TIMING –PROGRAMMING NON VOLATILE MEMORY (NVM )........................................................18
4POWER MANAGEMENT ..............................................................................................................20
4.1 MANUAL SLEEP FUNCTION .....................................................................................................20
4.2 MBUSX AUTOMATIC SLEEP.....................................................................................................20
4.3 IDLE MODE WITHOUT LISTENING TO RF....................................................................................20
4.4 POWER CYCLING .....................................................................................................................21
5INSTALLATION AND BINDING....................................................................................................22
5.1 AVAILABLE ADDRESS REGISTERS,KEY REGISTERS AND FLAG REGISTERS....................................22
5.2 THE INSTALLATION AND BINDING PROCESS................................................................................22
5.3 EXAMPLES ..............................................................................................................................24
6ENCRYPTION AND DECRYPTION..............................................................................................25
6.1 KEY EXCHANGE.......................................................................................................................25
6.2 ENABLING ENCRYPTION AND DECRYPTION ................................................................................25
6.3 THE FLAG REGISTER ................................................................................................................25
6.4 LINK LAYER ENCRYPTION.........................................................................................................25
6.5 TRANSPORT LAYER ENCRYPTION.............................................................................................26
6.6 MAILBOX PRE-ENCRYPTION......................................................................................................26
6.7 EXAMPLES ..............................................................................................................................27
7TWO-WAY COMMUNICATION.....................................................................................................30
7.1 MAILBOX REGISTER .................................................................................................................30
7.2 FLAG REGISTER /AUTO-MESSAGE FLAG REGISTER....................................................................31
7.3 MAILBOXES.............................................................................................................................32
7.4 AUTOMATICALLY REPLY WITH A STANDARD MESSAGE.................................................................33
7.5 AUTOMATICALLY REPLY WITH MESSAGE FROM A MAILBOX ..........................................................34
7.6 AUTOMATICALLY REPLY WITH TEMPLATE FROM A MAILBOX .........................................................34
7.7 TWO-LEVEL AUTO-REPLY .........................................................................................................34
7.8 AUTOMATIC ADDRESSING ........................................................................................................34
7.9 MBUS4: KEY CHALLENGE FUNCTION TO SUPPORT INFINITE NUMBER OF INSTALLED SLAVES .......34
7.10 EXAMPLES ............................................................................................................................37
8REPEATER MODE........................................................................................................................39
9MBUS4 EXTRA FEATURES.........................................................................................................40
9.1 ANTENNA TUNING FEATURE......................................................................................................40
9.2 ITALIAN CIG EXTENSION OF WIRELESS M-BUS..........................................................................40
9.3 CATEGORY 1RECEIVER ...........................................................................................................40
9.4 WIZE PROTOCOL.....................................................................................................................40
APPENDIX A CONFIGURATION COMMAND DETAILS.....................................................................41
APPENDIX B CONFIGURATION MEMORY........................................................................................50
APPENDIX C CONFIGURATION MEMORY DEFAULTS....................................................................56
APPENDIX D ADDITIONAL EXAMPLES.............................................................................................58
DOCUMENT REVISION HISTORY..........................................................................................................59

Page 2of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
Table of Tables
Table 1 –MBUS Feature Sets Overview....................................................................................................5
Table 2 –Configuration Commands overview............................................................................................9
Table 3 –Softcommands..........................................................................................................................10
Table 4 –M-Bus mode overview..............................................................................................................14
Table 5 –State names and descriptions ..................................................................................................16
Table 6 –Timing numbers, from RESET or SLEEP to IDLE...................................................................17
Table 7 –Timing numbers, in and out of CONFIG...................................................................................17
Table 8 –Timing numbers, in and out of MEMORY_CONFIG.................................................................18
Table 12 –Timing numbers, configuration commands with arguments but no response data................19
Table 15 –Standard message autoreply codes.......................................................................................33
Table 16 –Configuration Memory ............................................................................................................50
Table of Figures
Figure 1 –Block diagram............................................................................................................................7
Figure 2 –Wireless M-Bus Link..................................................................................................................7
Figure 3 –Configuration mode flow diagram..............................................................................................8
Figure 4 –UART interface packet transmission (RXD pin) ......................................................................11
Figure 5 –UART interface packet reception (TXD pin)............................................................................11
Figure 6 –State diagram. State transitions for autosleep is not shown. ..................................................16
Figure 7 –Timing definitions, from RESET or SLEEP to IDLE ................................................................17
Figure 8 –Timing definitions, in and out of CONFIG................................................................................17
Figure 9 –Timing definitions, in and out of MEMORY_CONFIG .............................................................18
Figure 13 –Timing definitions, commands with arguments but no response data. .................................18
Figure 16 –Current vs Time for Auto Sleeping Slaves ............................................................................21
Figure 17 –Installation and binding process............................................................................................23
Figure 18 –Encryption key lookup ...........................................................................................................25
Figure 19 - Key challenge diagram...........................................................................................................36
Table of Examples
Example 1 –Setting Install mode.............................................................................................................24
Example 2 –Binding a slave to a master .................................................................................................24
Example 3 –Message with Link Layer encryption ...................................................................................27
Example 4 –Message with Transport Layer encryption...........................................................................28
Example 5 –Write to mailbox...................................................................................................................37
Example 6 –Read mailbox.......................................................................................................................38
Example 7 –Encrypt mailbox #1 ..............................................................................................................38
Example 8 –Changing RF Channel.........................................................................................................58
Example 9 –Changing MAN_ID...............................................................................................................58

Page 3of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
Abbreviations
Abbreviation
Description
RSSI
Received Signal Strength Indicator
NTA 8130
Dutch companion standard
EN13757-4 (2013)
Wireless M-Bus Standard
OMS
Open Metering System, companion standard
NVM
Non Volatile Memory
LBT
Listen Before Talk
SML
Short Message Standard, please see EN13757-4 for details
DLMS
Please see EN13757-4 for details
VIF
Value Information Field, please see EN13757-4 for details
DIF
Data Information Field, please see EN13757-4 for details

Page 4of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
1 Introduction
1.1 Quick Start
The Module has a UART interface that is used for both Wireless M-Bus packet data and module configuration. Use
the UART format with settings (19200, 8, 1, N, no flow control).
How do I configure the M-Bus mode, RF channel or any other parameter?
To change configurable parameters:
1. Send one byte to the module with the value 0x00 or assert the CONFIG-pin. This will take the module into
configuration mode. More about configuration mode is found in chapter 2.1
2. Use special commands to access the configuration registers and test modes. All the commands for the
configuration are found in chapter 2.2
3. Exit from configuration mode by sending the ‘X’ command.
4. Start using the module as normal in packet mode. In some cases you need to reset the module for the changes
to take effect. Details about sending and receiving packet data is found in chapter 2.3.
How do I transmit data?
Send your data to the RXD pin on the module.The first byte of the message must contain the message length sent
over UART. The maximum lengthbyte is 0xF6 since link layer header is added automatically. The module will
transmit the data when the whole packet is received. See page 11 for details about the frame format for
transmitting data. Details about sending and receiving packet data is found in chapter 2.3.
How do I receive data?
Any received RF data packet with correct Wireless M-Bus format and check sums will be output on the TXD pin.
Optionally the meter address (first M-Bus block) is added to the data string. The RSSI value (received signal
strength) can optionally be appended to the message. Also CRC and start/stop bytes can be added. See page 11
for details about the frame format for receiving data. Details about sending and receiving packet data is found in
chapter 2.3.
What about the antenna?
In most cases a simple quarter wavelength wire or a PCB track will do. Connect a piece of wire to the RF pin with
length corresponding to the quarter of a wavelength. For space limited products, contact Radiocrafts and we will
recommend the best antenna solution for your application.
Radiocrafts also offer an Application Note on tuning a 169 MHz antenna in AN025, found here:
https://radiocrafts.com/resources/application-notes/

Page 5of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
1.2 Differencies between RC11xx and RC17xx series
This User Manual describes the embedded protocol of the Wireless M-Bus modules from Radiocrafts. The MBUS
firmware is available as different feature sets targeting specific applications. The hardware has the same size and
pin-out for all frequency versions, and the different feature sets available are listed in the table below. The feature
sets and the embedded functions are independent of the frequency, so this User Manual is valid for all versions
RC11xx(HP)-MBUS3 and RC1701HP-MBUS4. Detailed information on how to use the different feature sets is
found in this User Manual. Additional information about the Wireless M-Bus packet structure for NTA 8130
compliance is described in Application Note 011 and is available on request.
Table 1 –MBUS Feature Sets Overview
Feature List
Feature Set
RC11xx-MBUS
(MBUS3TM)
RC17xx-MBUS
(MBUS4TM)
General
General Wireless M-Bus modem,
with OMS featureset.
Wireless M-Bus mode N at 169
MHz
Network role
Master, Slave or Repeater
Master, Slave or Repeater
Modes
C1, S1, S2, T1, T2
N1, N2
Encryption
AES mode 4 and 5, and ELL
encryption mode 1
AES mode 4 and 5, and ELL
encryption mode 1
Installation mode
Yes, according to OMS
Yes
Number of installed meters
Up to 64
256 internally, unlimited externally
(>1000 meters per concentrator)
Filter function
Master only receives messages
from installed/registered meters
(optional)
Master only receives messages
from installed/registered meters
(optional)
Two way communication
Yes, according to OMS
Yes, for N2 mode
Automatic message generation
from Master
Yes, patented automatic message
generation.
According to OMS.
Supporting two-way slaves.
Standard response or a
predefined message from
mailboxes or templates.
Yes, patented auto message
generation.
Special support for handling of
> 1000 meters (Slaves).
The command set used to configure the MBUS modules are described in Appendix A .
1.3 Optional custom specific version
As an option to the standard feature sets, a full Wireless M-Bus application layer can be integrated in the module
based on customer specification. In this case all the application layer protocol and timing will be handled internally
by the module. Radiocrafts offer multiple such variants:
•MBUS with Pulse Counter
oRC1140/60/70/80-MPC1
oRC1701HP-MPC1
•MBUS Sensor Module
oRC1180-MSM
oRC1701HP-MSM
•Wize protocol
oRC1701HP-WIZE

Page 6of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
1.4 Important note on patented technology
Some of the technical solutions described in this User Manual are based on patented technology. In particular the
methods used in the MBUS3 and MBUS4 to meet the T2 and N2 timing requirements for a master, using an
address register, a flag register, an encryption key register combined with an auto-message generator for standard
messages and its combination with a mailbox with pre-generated messages or templates, and a given message
priority, depending on incoming messages, are subject to patenting.
Any infringements of patents and IP rights held by Radiocrafts will be prosecuted to the fullest extent.

Page 7of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
2 Basic Functionality
The figure below shows a simplified block diagram of the module:
Figure 1 –Block diagram
The host use the UART Interface to send and receive Wireless M-Bus data. The UART packet content, like the
addition of RSSI, CRC and start/stop bytes, can be changed in the configuration mode.
When the module receives a Wireless M-Bus packet over RF it will send the packet over the UART interface on the
TXD line. When the host MCU wants to transmit a Wireless M-Bus packet over the RF, it must send the packet
through the UART interface on the RXD line.
Figure 2 –Wireless M-Bus Link

Page 8of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
2.1 UART Interface –Module Configuration
The configuration of the module can be changed in-circuit from the host during operation, at the time of installation
of the equipment or at the manufacturing test. The configuration is changed by sending commands on the UART
interface after the module is set in configuration mode. The configuration mode is entered by sending 0x00 to the
module, or by asserting the CONFIG pin (set low).
In configuration mode the module will respond by sending a ‘>’ prompt on the TXD pin. This indicates that the
module is ready to receive commands. The CONFIG pin (if used) can then be de-asserted.
Note! The CONFIG pin must be de-asserted before the Exit command (‘X’) is sent to the module in order to
return to normal operation.
After a command is executed, the module responds with the ‘>’ prompt character again, indicating it is ready for a
new command. Do not send a new command before the ‘>’ prompt is received. The time required to execute a
command can vary depending on the command (see the Timing Information section). There is no ‘>’ prompt after
the ‘X’ exit command.
The parameters that are set by dedicated configuration commands (‘C’, ‘P’ and so on) take immediate effect after
returning to normal operation (IDLE), but will not be stored in non-volatile memory and will be lost in case the
supply power is turned off or if the module is reset. These parameters are for example the radio channel and output
power.
Permanent changes of parameters can be done by writing to the configuration memory using the memory
command ‘M’. These are for example default radio channel, default output power and M-Bus mode, see Appendix
A for details.
Figure 3 illustrates how to use the UART interface to enter configuration mode, change configuration parameters
and return to IDLE mode.
Figure 3 –Configuration mode flow diagram

Page 9of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
2.2 UART Interface –Configuration Commands
The UART interface is connected to a command and packet engine. Table 2 shows an overview of the available
commands when the module is in configuration mode. The details for each command is found in Appendix A .
Table 2 –Configuration Commands overview
Command
Parameter
MBUS3
MBUS4
Stored in NVM (Flash)
Stored in RAM
ASCII
hex
‘A’
0x41
Auto-message flags
✔
✔
✘
✔
‘B’
0x42
Bind
✔
✔
✔
✘
‘C’
0x43
Channel
✔
✔
✘
✔
‘E’
0x45
Encrypt
✔
✔
✘
✔
‘F’
0x46
C-field
✔
✔
✘
✔
‘G’
0x47
M-Bus mode
✔
✔
✘
✔
‘I’
0x49
Install
✔
✔
✘
✔
‘K’
0x4B
Key register
✔
✔
✔
✘
‘L’
0x4C
List binding
✔
✔
✔
✘
‘M’
0x4D
Memory configuration
✔
✔
✔
✘
‘N’
0x4E
Access Number
✔
✔
✘
✔
‘O’
0x4F
Read Auto-message flag register
✔
✔
✘
✔
‘P’
0x50
Output power
✔
✔
✘
✔
‘Q’
0x51
Quality Indicator
✔
✔
✘
✔
‘R’
0x52
Read mailbox
✔
✔
✘
✔
‘S’
0x53
Signal Strength (RSSI)
✔
✔
✘
✔
‘T’
0x54
Destination address
✔
✔
✘
✔
‘U’
0x55
Temperature monitoring
✔
✔
✘
✔
‘V’
0x56
Voltage monitoring
✔
✔
✘
✔
‘W’
0x57
Write to mailbox
✔
✔
✘
✔
‘X’
0x58
Exit command
✔
✔
✘
✔
‘Y’
0x59
Memory Read one byte
✔
✔
✘
✔
‘Z’
0x5A
Sleep mode
✔
✔
✘
✔
‘a’
0x61
Auto-message flags for 4 slaves in RAM
✘
✔
✘
✔
‘b’
0x62
Bind for 4 slaves in RAM
✘
✔
✘
✔
‘k’
0x6B
Key register for 4 slaves in RAM
✘
✔
✘
✔
‘l’
0x6C
List binding for 4 slaves in RAM
✘
✔
✘
✔
‘o’
0x6F
Read Auto-message flag register for 4 slaves in RAM
✘
✔
✘
✔
‘s’
0x73
Continious Signal Strength (RSSI)
✘
✔
✘
✔
‘0’
0x30
List Configuration Memory
✔
✔
✘
✔
‘1’
0x31
Test mode 1
✔
✔
✘
✔
‘2’
0x32
Test mode 2
✔
✔
✘
✔
‘3’
0x33
Test mode 3
✔
✔
✘
✔

Page 10 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
Command
Parameter
MBUS3
MBUS4
Stored in NVM (Flash)
Stored in RAM
ASCII
hex
‘4’
0x34
Test mode 4
✔
✔
✘
✔
‘7’
0x37
Test mode 7
✘
✔
✘
✔
‘8’
0x38
Test mode 8
✘
✔
✘
✔
‘@RC’
0x40 0x52 0x43
Reset Configuration to factory defaults
✔
✔
✘
✔
‘@RR’
0x40 0x52 0x52
Reset Radio
✔
✔
✘
✔
2.3 UART Interface –Send and receive messages
The module acts as a buffered packet radio, hence all data to be sent is stored in the module before they are
transmitted by the RF circuitry. Likewise, when data is received they are stored in the module before they are sent
to the host. This allows the communication controller to add address information, CRC and encryption during
transmission, and to do error check and decryption of the received data.
In normal data mode, the first byte sent to the module is interpreted as the length field. The module will then read
that number of bytes from the UART, add packet information according to module configuration and transmit. The
maximum length of the message sent to the module is 0xF6, the minimum length is 0x01. The maximum length
corresponds to 255 bytes including the link layer as transmitted on the air.
The length byte values > 0xF6 have been given some special meaning in the RC modules and are referred to as
“softcommands” since they are commands that are sent when the module is in normal data mode and not in
command and configuration mode.
Table 3 –Softcommands.
Length byte /
soft command
MBUS3
MBUS4
Set
0x00
✔
✔
Set the module in command and configuration mode
0x01-0xF6
✔
✔
Legal length values
0xF7-0xF9
✔
✔
Illegal length values. Reserved for future use. Module will return to IDLE.
0xFA
✘
✔
Override LBT
0xFB
✘
✔
No response message to be sent, module will go to IDLE mode
0xFC
✘
✔
“Key challenge” transfer from host to module
0xFD
✘
✔
Set module in IDLE mode, enable RF receiver (use after SLEEP)
0xFE
✔
✔
Module will send “empty” message (link layer only, no application layer)
0xFF
✔
✔
Set module in IDLE mode, disable RF receiver (UART only)

Page 11 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
Frame format for transmitting data
The data frame for the UART RXD pin (input for transmitting a Wireless M-Bus packet) is built like this:
Figure 4 –UART interface packet transmission (RXD pin)
L is the length (not including the length byte itself), followed by the application data with the CI byte first. CI is the
Control Information byte. The application data typically contains the application header (transport layer), and data
points with VIF and DIF codes. The application data can also be SML or DMLS or manufacturer specific.
An Extended Link Layer (ELL) can be added before the application data using this structure:
L + CIELL + ELL + CIAPL + APPL_DATA
The HEADER and C-field (and adjusted L value) is added to the Wireless M-Bus packet automatically by the
module before transmitting over RF and both can be changed in configuration mode.
To transmit only a HEADER without Application data (CI+APPL_DATA) a L=0xFE can be sent to the module UART
without additional bytes.
Frame format when receiving data
The data frame for the UART TDX pin (Output for received Wireless M-Bus packets) is built like this:
Figure 5 –UART interface packet reception (TXD pin)
Data in blue and yellow are optional output parts of the UART message and can be enabled in configuration mode
by the DATA_INTERFACE and RSSI_MODE configuration parameters.
L is the length byte and is always present. It does not include itself or the START/STOP bytes, but will include
RSSI and CRC if enabled. CRC is calculated from length byte including RSSI (if enebled).
Note! The length bytes itself must be reduced by 2 before calculating CRC on host. The length byte was
shorter at calculation in module as the CRC was not added at time of calculation.
CI
APPL_DATA
L
START
L
HEADER
APPL_DATA
RSSI
CRC
STOP
C
M_ID2
M_ID1
U_ID4
U_ID3
U_ID2
U_ID1
VER
DEV
CRC1
CRC2
L=Lenght of {C+HEADER+CI+APPL_DATA+RSSI+CRC}
Enable by RSSI_MODE
Enable by DATA_INTERFACE
Enable by DATA_INTERFACE
CI

Page 12 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
When setting DATA_INTERFACE = 1, the received HEADER will not be sent on the UART (typically used on a
slave). However, to be able to notify the external application when an Acknowledgement is received (“empty”
frame), a special string can be used. By setting DATA_INTERFACE = 3, the two byte string 00:E5h (i.e. L = 0) will
be sent on the UART when an empty acknowledge frame is received.
Application data (CI + APPL_DATA) is always present (except when only a HEADER is received).
For host applications using a UART buffer the timing information used for parsing could be lost. In this case a start
and stop byte can be used. Setting DATA_INTERFACE = 4 will add a START byte (68h) and a STOP byte (16h) to
the message. This is only used for the module-to-host communication direction (TXD). Setting DATA_INTERFACE
= 8 will add a two byte CRC checksum, and DATA_INTERFACE = 0Ch will add START/STOP bytes and CRC. The
CRC is sent MSByte first.
The RSSI value is appended when RSSI_MODE = 1.
2.4 Network Topology
A Wireless M-Bus supported metering system normally consists of a number of heat-, gas-, water and/or electricity
meters which reports their meteorological readings to a concentrator. The concentrator acts as the Master in the
system while the meters are Slaves. In the standard the Master is referred to as “Other”.
The Radiocrafts Wireless M-Bus family of modules can be configured to have a role as either Master or Slave. The
Slave contains a unique address, and when sending a meter reading this address is added to the wireless
message. The message from a Slave does not contain any Master address but the Master module within range will
receive the message, and based on the Slave address (if the Slave is installed and the Master is configured for
filtering), it will decode the message and send the data on its serial interface (TXD-pin).
In two-way communication modes, the battery operated meter (slave) will keep the receiver “on” for a short time.
During this time slot the master can acknowledge the received message in order to open the communication
channel (NTA 8130), or send a command (OMS) and thereby start a communication sequence.
MBUS3 (OMS) and MBUS4 also allows for a one-way (unidirectional) repeater. The repeater will re-transmit all
messages from slaves within range. Modules with MBUS3 and MBUS4 feature sets can be configured as a
repeater.
MBUS3 has since its original release been extended to support the new C-mode (Compact mode), in addition to
OMS functionality. A unique feature of MBUS3 is that T mode and C mode messages can be received in parallell
with the same configuration.
For battery operated devices the slave is always initiating the communication, and the master must then transmit (if
need) within a short time window (2-3 ms in the T mode). After one such “ping-pong” sequence, the slave will have
a pause (enter sleep mode) for 2-5 seconds, before it again do a new transmission allowing the master to do
another transmission. This means that all messages to be sent from the master must be ready and transmitted
within a very short time. The MBUS3 Auto-message generator and Mailbox features make this task easy and
doable (patented implementation).
MBUS3 supports 64 slaves registered in a master.
MBUS3 also support reception of mode C. Mode C can be received in combination with mode T. The module also
automatically receives and distinguish between Frame Format A and B. The current implementation supports C1
mode (unidirectional) as specified in the EN 13757-4 (2013). The timing of C2 mode is currently not supported. C
mode meters can be installed in the Master module, optionally with encryption keys, mixed with T mode meters.

Page 13 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
The module supports the new Extended Link Layer (ELL), its new AES-128-CTR mode of encryption, and the new
compact frame formats, all according to EN13757-4 (2013). The new ELL can be used for all modes.
The MBUS4 supports the mode N (169 MHz) variant of the Wireless M-Bus standard as specified in the EN 13757-
4 (2013). The implementation supports both N1 (unidirectional communication) and N2 (bi-directional
communication). That is, two-way communications with transmission and reception by both Slave and Master is
implemented, including the two-way timing for sleeping Slaves.
The MBUS4 functionality is similar to the MBUS3 functionality, with the addition of the Master supporting 256
meters (Slaves) internally and > 1000 Slaves registered externally (in the host).
As for MBUS3, the MBUS4 Master can be configured to receive all messages, or only installed meters. Messages
to/from installed meters can be encrypted/decrypted.
The MBUS4 receives and decodes mode N with both Frame Format A and B automatically in real-time. The Frame
Format used for transmission of messages is set by the “PREAMBLE_LENGTH” parameter, as described below.
The number of channels in mode N were extended in the 2018 revision of EN13757-4. This revision also added a
new data rate at 6.4 kbps. The channel and data rate settings to support this is shown below.
The MBUS4 support both Application Layer (i.e. Transport Layer) encryption and the new Link Layer Encryption,
using the Extended Link Layer, as specified in EN13757-4 (2013). The module accepts all CI-fields and will
automatically use the correct encryption scheme. Encryption / decryption is enabled in the Flag Register. The
default value of the Flag Register encryption / decryption flags are set using the ENCRYPT_FLAG /
DECRYPT_FLAG configuration parameters as for MBUS3. When ELL is used and encryption is enabled, the
module also automatically adds the correct PayLoad CRC. The PayLoad CRC can therefore be set to 0x00 by the
host in this case.
2.5 MBUS Basic functionality
The module offers a buffered packet radio acting as a Wireless M-Bus modem. The module contains a fully
embedded protocol supporting the following modes:
•Stationary mode S (S1, S1-m, S2)
•Frequent transmit mode T (T1 and T2)
•Frequent receive mode R2
•C1 mode
•Narrowband mode N (N1 and N2)
The mode is configurable by the MBUS_MODE parameter.

Page 14 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
The required M-Bus mode is configured by setting the module in configuration mode and entering appropriate
UART commands. The following modes are supported:
Table 4 –M-Bus mode overview
M-Bus Mode
Set
Comments
S1/S2
short preamble
MBUS_MODE = 0
PREAMBLE_LENGTH = 0
The RF channel (channel 11) and data rate
(32.768 kchip/s) are set internally in the
module according to the S mode, and will
override any settings in the RF_CHANNEL
and RF_DATA_RATE configuration
registers. This setting can also be used for
T2 mode slave receive and master transmit.
S1/S2
long preamble
MBUS_MODE = 0
PREAMBLE_LENGTH = 1
T1
MBUS_MODE = 1
The RF channel (channel 12), data rate
(100 kchip/s) and preamble length are set
internally in the module according to the T
mode, and will override any settings in the
RF_CHANNEL, RF_DATARATE and
PREAMBLE_LENGTH configuration
registers. This setting can also be used for
T2 mode slave transmit and master receive.
T2 slave
MBUS_MODE = 2
NETWORK_ROLE = 0
The RF channel (channel 11 or 12), data rate (32.768
or 100 kchip/s) and preamble length are set internally
in the module according to the T2 mode and the
selected Network Role, either being a Slave
(NETWORK_ROLE = 0) or a Master
(NETWORK_ROLE = 1), and change according to
receive/transmit. It will override any setting in the
RF_CHANNEL configuration register.
T2 master
MBUS_MODE = 2
NETWORK_ROLE = 1
R2
RF_CHANNEL = 1-10
MBUS_MODE = 4
The data rate (4.8 kchip/s) and preamble length are
set internally in the module according to the R mode.
C1
MBUS_MODE = 9
C2
MBUS_MODE = 8
C1+T1
MBUS_MODE = 10
The RF channel, data rate and preamble length are
set internally in the module
C1+T2
MBUS_MODE = 11
N1
MBUS_MODE = 17
N2
MBUS_MODE = 16
The module supports automatic generation of the Wireless M-Bus frame, that is:
- Preamble (header + synchronisation)
- Adding the first block (C-field and address/manufacturing ID)
- CRC
- Postamble
The RF signal is Manchester coded or "3 out of 6" coded for increased signal integrity (S and T modes).
The default M-Bus mode is entered and stored in the modules’ non-volatile memory (MBUS_MODE). The M-Bus
mode can also be changed using the ‘G’ command.
The default C-field is entered and stored in the modules’ non-volatile memory (CONTROL_FIELD). The C-field can
also be changed using the ‘F’ command (volatile memory).
The default Manufacturer ID and unique meter Address is entered and stored in the modules’ non-volatile memory.
The destination address (or module address) can also be changed using the ‘T’ command. Using the ‘T’ command,
the address is not stored in non-volatile memory. To do a permanent change, use the ‘M’ command.

Page 15 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
The module has an internal buffer and transmits application data as soon as the whole packet is received based on
the packet length (first byte of the application frame). The module also has a timeout feature that will empty the
input buffer in case of false data packets. The default timeout is 2 seconds.Max total payload is 246 bytes, giving
255 bytes when including the header in the first block.

Page 16 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
3 Timing
This chapter describes the function critical timing between different states and for some commands/operations in
configuration mode.
3.1 States overview
The figure below shows the different states of the module. Table 5 explains the details of each state.
Figure 6 –State diagram. State transitions for autosleep is not shown.
Table 5 –State names and descriptions
State
Description
RESET
Module is reset. All configurations not stored in NVM are lost.
SLEEP
The module is in a low power consumption mode and needs to be woken up by
sending 0xFF on UART RXD to enter IDLE state.
IDLE
This is the normal state where the module both searches for preamble on RF (if
enabled) and wait for a character to be received on the UART.
RXD
The state when receiving characters on UART from the host, filling up the internal
buffer.
TX
When the data is transmitted on the air.
RX
When data is received from the air after preamble detection.
TXD
The state where the received data is sent to the host on the UART.
CONFIG
CONFIG is the configuration mode, the state entered by sending 0x00 or
asserting the CONFIG pin and is entered during parameter configuration.
MEMORY_CONFIG
MEMORY CONFIG is the sub-state of CONFIG entered by the ‘M’ command
where the non-volatile configuration memory is being programmed.

Page 17 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
3.2 Timing –from RESET and SLEEP to IDLE
Figure 7 –Timing definitions, from RESET or SLEEP to IDLE
Table 6 –Timing numbers, from RESET or SLEEP to IDLE
Symbol
MBUS3
MBUS4
Description / Note
tRESET-IDLE
6.6 ms
9.1 ms
tSLEEP-IDLE
1.6 ms
3.2 ms
For UART data rates up to 4.8 kBd the sequence 0xFF :
0x00 can be sent without delay (from Sleep to Config). For
higher UART baud rates, add 2 ms delay before setting
Config mode
3.3 Timing –in and out of CONFIG mode
For tCONFIG_PROMPT it is recommended to
Figure 8 –Timing definitions, in and out of CONFIG
Table 7 –Timing numbers, in and out of CONFIG
Symbol
MBUS3
MBUS4
Description / Note
tCONFIG-PROMPT
Wait for prompt
Time from 0x00 on UART RXD or CONFIG pin is set low
until prompt (“>”) is received in UART TXD
tCONFIG-IDLE
146us
1.2ms
Time from end of ‘X’ character on UART RXD to IDLE
tCONFIG-SLEEP
~150us
Time from end of ‘Z’ character on UART RXD to IDLE

Page 18 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
3.4 Timing –Programming Non Volatile Memory (NVM )
When writing to NVM the operation must not be interrupted by reset or power off. This can cause the memory to be
corrupted. Therefore, it is important to wait for the prompt on TXD after issuing such commands.
M-command, @RC-command
Both the M-command and the @RC-command are programming the configuration area of the NVM.
Figure 9 –Timing definitions, in and out of MEMORY_CONFIG
Table 8 –Timing numbers, in and out of MEMORY_CONFIG
Symbol
MBUS3
MBUS4
Description / Note
tMEMORY-CONFIG
31 ms
31ms
In this period the internal flash (non-volatile memory) is
programmed. Do not reset, turn the module off, or allow
any power supply dips in this period as it may cause
permanent error in the Flash configuration memory.
After the last command parameter byte the host should
wait for the ‘>’ prompt before any further action is done
to ensure correct re-configuration.
B,K –command
These commands are reading back, changing and writing a larger portion of the NVM and thus uses longer time
than the M-command. They too return the prompt character and it is important to wait for it.
Figure 10 –Timing definitions, commands with arguments but no response data.

Page 19 of 60
©2019 Radiocrafts AS
MBUS User Manual (ver 2.01)
MBUS USER MANUAL
Table 9 –Timing numbers, configuration commands with arguments but no response data
Command
Parameter
MBUS3
MBUS4
Comment
Any
TBYTE
Varies with UART datarate
Any
TUART_BYTE
Varies with UART datarate
B,K
TWAIT_1
3.9 ms / 7.8ms
~50us
B,K
TWAIT_2
45 ms
55 ms
In this period the internal flash (non-volatile memory)
is programmed. Do not reset, turn the module off,
or allow any power supply dips in this period as
it may cause permanent error in the Flash
configuration memory. After the last command
parameter byte the host should wait for the ‘>’
prompt before any further action is done to
ensure correct re-configuration.