Operation

Operation modes

The product has the following operation modes:

  • lnactive, no ABB electricity meter is found

  • Normal operation - unencrypted mode

  • Normal operation - encrypted mode

Inactive mode

When the product does not have any contact with the ABB electricity meter, the LED will turn red and no data is sent. As long as the CMeX20W is powered, it will keep searching for an ABB electricity meter to connect to.

Normal operation - unencrypted mode

In normal operation unencrypted mode, the product will send unencrypted messages every 16th seconds. This mode is normally used when the master or AMR/AMM system does not handle AES encryption or if the AES key is unknown to the system.

In unencrypted mode, the information is sent in a wireless telegram with "short application header" (Cl= 0x7A). The unencrypted telegram contains only one address, "link layer address", which is composed of data that is taken from the header in the ABB electricity meter's telegram ("Manufacturer code, ID, Version and Device type). ln unencrypted mode, the CMeX20W is not sending its own address in the telegram.

Normal operation - encrypted mode

In normal operation encrypted mode, the product will send encrypted messages every 16th seconds. This mode is used to secure data that is sent from the product to the master or AMR/AMM system. To decrypt data, the master or system must know the unique 128 bit AES key to the meter. The unique 128 bit AES key is given at the delivery or at the demand of the customer.

In encrypted mode, the information is sent in a wireless telegram with "long application header" (Cl= 0x72). The encrypted telegram contains two addresses, the CMeX20W's own address that is needed for choosing the right key for decryption and the ABB meter's address "Application layer address", which is included in "long application header" and contains data taken from the header in the ABB meter's telegram ("Manufacturer code, ID, Version and Device type). The telegram's "link layer address" contains the CMeX20W's own address ("Manucfacturer code, ID, Version and Device type). Device type for CMeX20W is 0x37 = "Radio converter, meter side".

AES key

In encrypted mode, a unique 128 bit AES key is required for all telegrams. It will be given either upon delivery or upon customer request.

M-Bus

The product follows the M-Bus standards EN13757-2, EN13757-3 and EN13757-4.

M-Bus product identification

At operation in encrypted mode, the product can be identified by the following information in the "Link Layer Address":

  • Manufacturer string = ELV

  • Medium/DEVICE TYPE = 0x37 = "Radio converter, meter side"

  • Generation/Version = 30 (CMeX20W)

Wireless M-Bus modes

The product uses wireless M-Bus mode T1.

Denomination of values in reports

Denomination

Description

serial-number

M-Bus master id

device-identification

M-Bus slave id

created

Time stamp

value-data-count

Index at multiple telegram.

Usually 0.

manufacturer

Manufacturer

version

Hardware version

device-type

M-Bus slave device type

access-number

Number of times the meter has been read

status

Status

signature

Reserved for future use

fabrication-no,,inst-value,0,0,0

Id for the wireless M-Bus master CMeX50

act-duration,minute(s),inst-value,0,0,0

The values age in minutes

rf-level,dbm,inst-value,0,0,0

Signal strength in dBm

ext-temp,°c,inst-value,0,0,0

Temperature, momentary value

ext-temp,°c,inst-value,0,0,1

Temperature, 1 hour rolling average

digital-input,,inst-value,0,0,0

Product status

other-sw-version,,inst-value,0,0,0

Software version

manufacturer-specific,,inst-value,0,0,0

Denomination of values for use in filters

Denomination

Description

mbus.dib.fabrication-no.0.0.0.0

Id for the wireless M-Bus master CMeX50

mbus.dib.act-duration,minute(s).0.0.0.0

The value age in minutes

mbus.dib.rf-level.0.0.0.0

Signal strength in dBm

mbus.dib.ext-temp.0.0.0.0

Temperature, momentary value

mbus.dib.ext-temp.0.1.0.0

Temperature, 1-hour rolling average

mbus.dib.digital-input.0.0.0.0

Product status

Send data (SND_NR)

During normal operation, a wireless M-Bus telegram of the type SND_NR ("Send, No Reply") is sent by default every 16th seconds.

Unencrypted telegram

All bytes from index 0 (L-field) are 4-to-6-bit coded according to the standard for wireless M-Bus mode T1. CRC byte and 4/8-bit postamble are also sent according to the standard but are not shown in the following table.

Byte index 2..9 is "Link layer address" that contains the address of the meter. Byte index 11..14 is "short application header".

Table 252. Unencrypted telegram

Byte index

Data

Description

0x55

preamble

0x55

preamble

0x55

preamble

0x55

preamble

0x55

preamble

0x54

sync word byte 0

0x3D

sync word byte 1

0

0x00

L-field

1

0x44

C-field = 0x44 = SND-NR

2..3

0xnnnn

Manufacturer field from the meter's telegram, e.g. "ABB"

4..7

0xnnnnnnnn

ID-field from the meter's telegram

8

0xnn

Version field from meter's telegram

9

0xnn

DeviceType field from meter's telegram

10

0x7A

Cl-field, 0x7A = "Short header follows"

11

0xnn

ACC = increment number from CMeX20W

12

0xnn

STATUS= status byte from meter's telegram

13..14

0x2000

CONFIG word = synchronous, unencrypted

15....

 

Meter's payload (all data after meter's header)


Encrypted telegram

All bytes from index 0 (L-field) is 4-to-6-bit coded according to the standard for Wireless M­ Bus mode T1. CRC-byte and 4/8-bit postamble are also sent according to the standard but are not shown in the following table.

Byte index 2..9 is "Link layer address" that contains the address of CMeX20W. Byte index 11..22 is "long application header" where index 11..18 is "application layer address" here contains the meter's address.

Table 253. Encrypted telegram

Byte index

Data

Description

0x55

preamble

0x55

preamble

0x55

preamble

0x55

preamble

0x55

preamble

0x54

sync word byte 0

0x3D

sync word byte 1

0

0x00

L-field

1

0x44

C-field = 0x44 = SND-NR

2..3

0x1596

Manufacturer field, 0x1596 = "ELV"

4..7

0xnnnnnnnn

ID-field, CMeX20W serial number

8

0xnn

Version field, CMeX20W version number

9

0x37

DeviceType-field, "Radio converter, meter side"

10

0x72

Cl-field, 0x72 = "Long header follows"

11..14

0xnnnnnnnn

ID-field from meter's telegram

15..16

0xnnnn

Manufacturer field from meter's telegram

17

0xnn

Version field from meter's telegram

18

0xnn

DeviceType-field from meter's telegram

19

0xnn

ACC = increment number from CMeX20W

20

0xnn

STATUS= status byte from meter's telegram

21..22

0x25n0

CONFIG word = "encryption mode 5", n = number of encrypted blocks

23..24

0x2F2F

"Decryption verification bytes"

25....

Meter's payload (all data after the meter's header)


Was this article helpful?

0 out of 0 found this helpful
Have more questions? Submit a request

Comments (0 comments)

Article is closed for comments.