Administration
The product can be identified using the following information:
-
Manufacturer string = 0x1596 = “ELV”
-
Version field = 2
-
Device type field = 0x1B = “Room Sensor”
The version field of the link layer address reflects the telegram version and will be changed only if the contents of the wireless M-Bus telegram is changed in some way due to a new product/software release. The actual software version number can be found in a dedicated record of the M-Bus telegram.
The product can operate in encrypted or unencrypted mode. In encrypted mode, a 128 bit AES key is used for all telegrams.
After activation, the product will send spontaneous unidirectional SND-NR telegrams every 3rd minute (C-field = 0x44 = SND-NR = Send, No Reply").
Unencrypted telegram as transmitted on-air:
Table 152. Unencrypted telegram
|
Byte index |
Data |
Description |
|---|---|---|
|
0x55 |
preamble |
|
|
0x55 |
preamble |
|
|
0x55 |
preamble |
|
|
0x55 |
preamble |
|
|
0x54 |
sync word byte 0 |
|
|
0x3D |
sync word byte 1 |
|
|
0x54 |
sync word byte 2 |
|
|
0x3D |
sync word byte 3 |
|
|
0 |
0x62 |
L-field = Number of bytes that follows, including CRC bytes |
|
1 |
0x44 |
C-field = 0x44 = SND-NR |
|
2 |
0x96 |
Byte 0 of manufacturer field, lsByte (0x1596 = "ELV") |
|
3 |
0x15 |
Byte 1 of manufacturer field, msByte |
|
4 |
0xnn |
Byte 0 of ID field, packed BCD, the two lsDigits |
|
5 |
0xnn |
Byte 1 of ID field, packed BCD |
|
6 |
0xnn |
Byte 2 of ID field, packed BCD |
|
7 |
0xnn |
Byte 3 of ID field, packed BCD, the two msDigits |
|
8 |
0xnn |
Version field |
|
9 |
0x1B |
Device type field, 0x1B = Room sensor |
|
10 |
0x7A |
CI-field, 0x7A = short application layer header follows |
|
11 |
0xnn |
ACC, 0..255, incremented by 1 after each transmission |
|
12 |
0xnn |
STATUS, normally 0x00 (see note 1) |
|
13 |
0x00 |
Byte 0 of CONFIG word, lsByte |
|
14 |
0x20 |
Byte 1 of CONFIG word, msByte (see note 2) |
|
15 |
0x2F |
Decryption verification byte 1 |
|
16 |
0x2F |
Decryption verification byte 2 |
|
17 |
0x02 (0x32) |
DIF = 16-bit integer, instantaneous value, storage number 0 (see note 3) |
|
18 |
0x65 |
VIF = "External temperature, unit is 0.01 centigrade" |
|
19 |
0xnn |
Byte 0 of current temperature, lsByte |
|
20 |
0xnn |
Byte 1 of instantaneous value, msByte |
|
21 |
0x42 (0x72) |
DIF = 16-bit integer, instantaneous value, storage number 1 (see note 3) |
|
22 |
0x65 |
VIF = "External temperature, unit is 0.01 centigrade" |
|
23 |
0xnn |
Byte 0 of 1-hour average temperature, lsByte |
|
24 |
0xnn |
Byte 1 of 1-hour average temperature, msByte |
|
25 |
0x82 (0xB2) |
DIF = 16-bit integer, instantaneous value, storage number 2 (see note 3) |
|
26 |
0x01 |
DIFE needed for storage number > 1 |
|
27 |
0x65 |
VIF = "External temperature, units is 0.01 centigrade" |
|
28 |
0xnn |
Byte 0 of 24-hour average temperature, lsByte |
|
29 |
0xnn |
Byte 1 of 24-hour average temperature, msByte |
|
30 |
0x22 (0x32) |
DIF = 16-bit integer, minimum value, storage number 0 (see note 3) |
|
31 |
0x65 |
VIF = "External temperature, unit is 0.01 centigrade" |
|
32 |
0xnn |
Byte 0 of 1-hour minimum temperature, lsByte |
|
33 |
0xnn |
Byte 1 of 1-hour minimum temperature, msByte |
|
34 |
0x12 (0x32) |
DIF = 16-bit integer, maximum value, storage number 0 (see note 3) |
|
35 |
0x65 |
VIF = "External temperature, unit is 0.01 centigrade" |
|
36 |
0xnn |
Byte 0 of 1-hour maximum temperature, lsByte |
|
37 |
0xnn |
Byte 1 of 1-hour maximum temperature, msByte |
|
38 |
0x62 (0x72) |
DIF = 16-bit integer, minimum value, storage number 1 (see note 3) |
|
39 |
0x65 |
VIF = "External temperature, unit is 0.01 centigrade" |
|
40 |
0xnn |
Byte 0 of 24-hour minimum temperature, lsByte |
|
41 |
0xnn |
Byte 1 of 24-hour minimum temperature, msByte |
|
42 |
0x52 (0x72) |
DIF = 16-bit integer, maximum value, storage number 1 (see note 3) |
|
43 |
0x65 |
VIF = "External temperature, unit is 0.01 centigrade" |
|
44 |
0xnn |
Byte 0 of 24-hour maximum temperature, lsByte |
|
45 |
0xnn |
Byte 1 of 24-hour maximum temperature, msByte |
|
46 |
0x02 (0x32) |
DIF = 16-bit integer, instantaneous value, storage number 0 (see note 3) |
|
47 |
0xFB |
VIF = use VIF extension table 0xFB |
|
48 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
49 |
0xnn |
Byte 0 of current relative humidity, lsByte |
|
50 |
0xnn |
Byte 1 of current relative humidity, msByte |
|
51 |
0x42 (0x72) |
DIF = 16-bit integer, instantaneous value, storage number 1 (see note 3) |
|
52 |
0xFB |
VIF = use VIF extension table 0xFB |
|
53 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
54 |
0xnn |
Byte 0 of 1-hour average relative humidity, lsByte |
|
55 |
0xnn |
Byte 1 of 1-hour average relative humidity, msByte |
|
56 |
0x82 (0xB2) |
DIF = 16-bit integer, instantaneous value, storage number 2 (see note 3) |
|
57 |
0x01 |
DIFE needed for storage number > 1 |
|
58 |
0xFB |
VIF = use VIF extension table 0xFB |
|
59 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
60 |
0xnn |
Byte 0 of 24-hour average relative humidity, lsByte |
|
61 |
0xnn |
Byte 1 of 24-hour average relative humidity, msByte |
|
62 |
0x22 (0x32) |
DIF = 16-bit integer, minimum value, storage number 0 (see note 3) |
|
63 |
0xFB |
VIF = use VIF extension table 0xFB |
|
64 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
65 |
0xnn |
Byte 0 of 1-hour minimum relative humidity, lsByte |
|
66 |
0xnn |
Byte 1 of 1-hour minimum relative humidity, msByte |
|
67 |
0x12 (0x32) |
DIF = 16-bit integer, maximum value, storage number 0 (see note 3) |
|
68 |
0xFB |
VIF = use VIF extension table 0xFB |
|
69 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
70 |
0xnn |
Byte 0 of 1-hour maximum relative humidity, lsByte |
|
71 |
0xnn |
Byte 1 of 1-hour maximum relative humidity, msByte |
|
72 |
0x62 (0x72) |
DIF = 16-bit integer, minimum value, storage number 1 (see note 3) |
|
73 |
0xFB |
VIF = use VIF extension table 0xFB |
|
74 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
75 |
0xnn |
Byte 0 of 24-hour minimum relative humidity, lsByte |
|
76 |
0xnn |
Byte 1 of 24-hour minimum relative humidity, msByte |
|
77 |
0x52 (0x72) |
DIF = 16-bit integer, maximum value, storage number 1 (see note 3) |
|
78 |
0xFB |
VIF = use VIF extension table 0xFB |
|
79 |
0x1A |
VIFE = "Relative humidity, unit is 0.1 percent" |
|
80 |
0xnn |
Byte 0 of 24-hour maximum relative humidity, lsByte |
|
81 |
0xnn |
Byte 1 of 24-hour maximum relative humidity, msByte |
|
82 |
0x02 |
DIF = 16-bit integer, instantaneous value, storage number 0 |
|
83 |
0xFD |
VIF = use VIF extension table 0xFD |
|
84 |
0x1B |
VIFE = "Digital inputs" |
|
85 |
0xnn |
Byte 0 of product status flags, lsByte (see note 4) |
|
86 |
0xnn |
Byte 1 of product status flags, msByte (see note 4) |
|
87 |
0x0D |
DIF = Variable length, instantaneous value, storage number 0 |
|
88 |
0xFD |
VIF = use VIF extension table 0xFD |
|
89 |
0x0F |
VIFE = "Other software version" |
|
90 |
0x05 |
LVAR = 5, length of ASCII string that follows |
|
91 |
0x30 |
'0' "1.0.0" backwards according to M-Bus standard (!) Index 91 to 95 is an example of how it will look. The revision might be other than what is written here. |
|
92 |
0x2E |
'.' |
|
93 |
0x30 |
'0' |
|
94 |
0x2E |
'.' |
|
95 |
0x31 |
'1' |
|
96 |
0x0F |
End-of-telegram marker |
|
97 |
0xnn |
Byte 1 of CRC of frame type B, msByte |
|
98 |
0xnn |
Byte 0 of CRC of frame type B, lsByte |
Note
1
STATUS, which is normally 0x00, has two error flags in bits 2 and 3:
Bit 2 = 1 (0x04) if the measured battery voltage drops under the low limit during transmission.
Bit 3 = 1 (0x08) if there is an error in the temperature/humidity sensor (see also notes 3 and 4).
Note
2
CONFIG word = 0x2000 if unencrypted.
CONFIG word = 0x2560 if encrypted (application layer encryption mode 5, six encrypted 16-byte blocks).
CONFIG bit 13 (SYNC ) is always 1 to indicate that the product transmits synchronous telegrams according to the standard EN13757-4:2013.
Note
3
In case of temperature/humidity sensor error, bits 4 and 5 of these DIFs are set to 1 to indicate "Value during error state". Bit 3 of STATUS will also be set to 1 and all temperature and humidity values will be cleared to zero (also see notes 1 and 4).
Note
4
Product status flags:
Bit 15: Toggles every hour (when the 24h min/max/average values have been updated)
Bit 14: Toggles every 10 minutes (when the 1h min/max/average values have been updated)
Bits 13..10: Unused, always 0
Bits 9..8: Operating time since activation:
Bits 7..4: Telegram transmission interval in minutes, binary value 011 = 3 minutes.
Bits 3..2: Unused, always 0
Bit 0: 1 if sensor error (same as STATUS bit 3, see also notes 1 and 3)
When encryption is enabled, a 9-byte extended link layer block is inserted at byte index 10..19. The application layer payload, from CI-field to the 0x0F end-of-telegram marker is encrypted. The CRC at the end of the telegram belongs to the link layer and is calculated after encryption.
Encrypted telegram as transmitted on-air:
Table 153. Encrypted telegram
|
Byte index |
Data |
Description |
|---|---|---|
|
0x55 |
preamble |
|
|
0x55 |
preamble |
|
|
0x55 |
preamble |
|
|
0x55 |
preamble |
|
|
0x54 |
sync word byte 0 |
|
|
0x3D |
sync word byte 1 |
|
|
0x54 |
sync word byte 2 |
|
|
0x3D |
sync word byte 3 |
|
|
0 |
0x70 |
L-field = Number of bytes that follows, including CRC bytes |
|
1 |
0x44 |
C-field = 0x44 = SND-NR |
|
2 |
0x96 |
Byte 0 of manufacturer field, lsByte (0x1596 = "ELV") |
|
3 |
0x15 |
Byte 1 of manufacturer field, msByte |
|
4 |
0xnn |
Byte 0 of ID field, packed BCD, the two lsDigits |
|
5 |
0xnn |
Byte 1 of ID field, packed BCD |
|
6 |
0xnn |
Byte 2 of ID field, packed BCD |
|
7 |
0xnn |
Byte 3 of ID field, packed BCD, the two msDigits |
|
8 |
0xnn |
Version field |
|
9 |
0x1B |
Device type field, 0x1B = Room sensor |
|
10 |
0x7A |
CI-field, 0x7A = short application layer header follows |
|
11 |
0xnn |
ACC, 0..255, incremented by 1 after each transmission |
|
12 |
0xnn |
STATUS, normally 0x00 (see note 1) |
|
13 |
0x60 |
Byte 0 of CONFIG word, lsByte |
|
14 |
0x25 |
Byte 1 of CONFIG word, msByte (see note 2) |
|
15..110 |
Encrypted payload (same data as unencrypted byte index) |
|
|
111 |
0xnn |
Byte 1 of CRC of frame type B, msByte |
|
112 |
0xnn |
Byte 0 of CRC of frame type B, lsByte |
Comments (0 comments)