M-Bus Rev. 4.8 communication protocol

Supported device types and versions
Communication line configuration
Communication station configuration
I/O tag configuration
Specific data of Multical III device
Parameters settings and data acquisition methods
Changes and modifications
Document revisions

Supported device types and versions

Communication implements data reading from devices that support the M-Bus protocol by the Rev. 4.8 specification. Communication was tested with MULTICAL® III, MULTICAL® 5 measuring devices by KARMSTRUP Company, CALSTREEM EEM-C measuring device by Danfoss Company, and PolluTherm Pt500 by Sensus.
The communication was also verified against the water flow meter Sensus MeiStream 150 with communication module HRI-Mei using an EthMBus-5 converter manufactured by JC-e (it was necessary to configure a converter to TCP mode and use a TCP/IP-TCP line category).

Communication line configuration

Line protocol parameters

The following station protocol parameters can be defined:

KeywordFull nameMeaningUnitDefault value
Change BaudrateValue Yes means that communication will be switched between modes 1 and 2 (only Serial line).
Value No means that communication will be performed using mode 1 (300 Bauds).
Send SND_NKE as BroadcastThe Yes value means that the SND_NKE (slave device initialization) command is sent as Broadcast before reading from the first station on the line.
The No value means that the SND_NKE command is sent to each device individually before the start of the reading.
Note: if the parameter is set to Yes, after sending Broadcast, there is a delay configurable by parameter WAI.

Communication station configuration

  • Communication protocol: M-Bus Rev 4.8
  • The station address is a decimal number within the range of 1..250 – slave address, it is derived from the serial number of the measurement device (last three digits). If the last three digits are greater than 250, the highest digit is not to be taken into account. If the serial number is one of the numbers of 000, 300, 400, 500, 600, 700, 800, 900, then it must be changed.

Station protocol parameters

The following station protocol parameters can be defined:

KeywordFull nameMeaningUnitDefault value
Address Scan ModeEach reading of values increments the station address. This mode can be used to find a device with an unknown address.-No
Retry CountRequest repetition count in case of a communication error.-2
Retry TimeoutDelay between request repetition in case of a communication error.ms100 ms
Wait First TimeoutFirst waiting for a response after sending the request.ms800 ms
Wait TimeoutDelay after transmitting the request before reading the response.ms500 ms
Max Wait RetryRepetition count of response readings till its finalization.-40

Wait After SND_NKE BroadcastDelay after sending a broadcast SND_NKE, before reading from the first station on a communication line.ms8000 ms
Wait before REQ_UD2 RequestDelay before sending the REQ_UD2 request to a slave.ms4000 ms
Set FCB Bit after SND_NKEThe parameter specifies whether an FCB bit in a first request after sending SND_NKE should be set to 1 (YES) or 0 (NO).-YES
Accept Following Records (0=disable,255=read all)If the slave station has Variable Data available, the parameter specifies the number of records read during one polling of the station. A value of 255 means that all available records will be read.-0
Send Application Reset before REQ_UD2Optional sending of "application reset" message (50h) prior to reading the values from the station.-NO
WakeUp LengthLength (given in characters) of the so-called wake-up message sent before each request. Value 0 disables the sending of the wake-up message.bytes0
WakeUp DelayThe delay between the wake-up message and a request.ms400


Accept Reply To Broadcast

If the station has address 254 (according to the protocol definition it is a broadcast address to which stations can respond), this parameter allows processing the response from any station. The practical use is on lines with a single station - in case of its exchange, it is not necessary to find out the address of a new device.


Full DebugEnables debug logs on the communication and acquired data.-NO

Multical IIIEnables decoding the Manufacture specific data of Multical III device.-NO

A string containing the protocol parameters is defined as follows:

Keyword=value;Keyword=value; ...



If a keyword with an invalid value in the initialization string is used, a corresponding default value according to the table 1 will be used.

I/O tag configuration

Possible I/O tag types: Ai, Ci, TiA, TiR, TxtI, TxtO

Two types of addresses can be configured:

  • Simple address: a number that is an index of the value in the M-Bus data packet. To get detailed information on unknown devices, activate debug logs using the FULL_DEBUG parameter.
    An example of debug log (individual rows correspond with addresses 1 to 9, value is displayed at the end of listing after the text "Val"):
    >> Adr.1,DF:0CH (8 digit BCD)(inst. val),VIF:05H=Energy 0*10^2 [Wh],VIFE:7DH=Multiplicative corr. factor 10^3,Val:0
    >> Adr.2,DF:0CH (8 digit BCD)(inst. val),VIF:15H=Volume 0*10^-1 [m3],Val:0
    >> Adr.3,DF:0CH (8 digit BCD)(inst. val),VIF:3DH=Volume Flow 0*10^-1 [m3/h],Val:0
    >> Adr.4,DF:0CH (8 digit BCD)(inst. val),VIF:2DH=Power 0*10^2 [W],Val:0
    >> Adr.5,DF:02H (16 bit int)(val during err),VIF:5AH=Flow temperature 0*10^-1 [C],Val:0
    >> Adr.6,DF:02H (16 bit int)(val during err),VIF:5EH=Return temperature 0*10^-1 [C],Val:0
    >> Adr.7,DF:03H (24 bit int)(val during err),VIF:60H=Temperature difference 0*10^-3 [K],Val:0
    >> Adr.8,DF:0CH (8 digit BCD)(inst. val),VIF:78H=Fabrication No.,Val:53155203
    >> Adr.9,DF:0CH (8 digit BCD)(inst. val),VIF:7DH=Extension of VIF-codes,VIFE:10H=Customer location,Val:53155203
  • Address of header objects: in 0.subadr format enables to address objects located in a header of an answer. A device can answer using fixed or variable responses that have different header contents. The following table lists header objects and their addresses for fixed and variable respond.

    ObjectValue typeAddress in fix respondAddress in variable respond
    Identification No.Ci, TxtI0.00.0
    ManufacturerTxtI (3 characters)-0.1
    Access No.Ci0.10.4

    An example of a debug log for variable response:

    Variable data respond CI=0x72 mode 1 from St:'B.MBUS_SENSUS'(0) detected.
    >> Adr.0.0,Identification No.,Val=53155203
    >> Adr.0.1,Manufacturer,Val='SEN'
    >> Adr.0.2,Version,Val=12
    >> Adr.0.3,Medium,Val=4
    >> Adr.0.4,Access Nr.,Val=50
    >> Adr.0.5,Status,Val=16
    >> Adr.0.6,Signature,Val=0


An output text I/O tag (TxtO) with address 1 is designated for writing. The opening sequence <68><Length><Length><68> and the ending <CRC><16> are added to the data written to the I/O tag.

The write is successful if a short reply <E5> is received from the station.

Example script for Sensus HRI-Mei (communication module for water meters Sensus HRI-MeiStream and Sensus HRI-MeiStream Plus):

; command Clearing Rotation Counters
; sent request and received response (header is first 4 bytes, footer is last 2 bytes)
;L:L.Sensus_Mei REQ-<68><08><08><68><73><00><51><0F><02><1F><20><7A><8E><16>
;L:L.Sensus_Mei RSP-<E5>

TEXT _stAdr = %Chr(%StrToI("16#00#")) ; station address
TEXT _val

_val := %Chr(%StrToI("16#73#")) + _stAdr + %Chr(%StrToI("16#51#")) + %Chr(%StrToI("16#0F#")) + %Chr(%StrToI("16#02#")) + %Chr(%StrToI("16#1F#")) + %Chr(%StrToI("16#20#")) + %Chr(%StrToI("16#7A#")) 
M.Mei_write := _val

Specific data of Multical III device

Multical III device sends extended "manufacture specific data". Activating the parameter MULTICALIII allows to configure I/O tags according to the following table:

AddressValue descriptionType
12Access counterCi
13Number of customer 1Ci
14Number of customer  2Ci

Parameters settings and data acquisition method

Recommended polling parameters are at least 1 minute. When the polling time comes, before polling the first station on the line, an SND_NKE(255) datagram is broadcasted, i.e. init for all measuring devices (Slaves) and the KOM process waits for a period specified by the WAI parameter. The slaves prepare all current measured values and implicitly change their Baudrate to 300.

Then the communication speed can be optionally changed to a higher speed (specified on the communication line as mode 2) by SND_UD data if it configured by the means of the Change Baudrate line parameter. Only baud rates 300/600/1200/2400/9600/19200/3840 are supported by M-Bus protocol.
Note: change of baud rate is supported only on SerialMOXA IP Serial Library, and RFC2217 Client line.

Then a REQ_UD2 request is sent to every slave (after waiting according to the value specified by the WBR parameter) to which they all should respond by the RSP_UD data datagram.

Times of individual values are not set to the time when the telegram was received, but to the time of the required polling period. So if the period is set to 1 hour, all the times of values are set to the given hour.

Note: Polling period, as well as station parameters, should be the same on all stations on a single line.



You can read a blog about M-Bus protocol: Communication – M-Bus

An example of communication

The attached ZIP contains the configuration of the line, station, and I/O tags with the M-Bus protocol that communicate with the Sensus MeiStream 150 flowmeter with the HRI-Mei communication module and using an EthMBus-5 converter manufactured by JC-e in UDP mode (the converter has an IP address of in the line configuration).


Changes and modifications

  • November 22nd, 2005 - Redesigned by M-Bus Rev. 4.8.

Document revisions

  • Ver. 1.0 - June 26th, 2000 – Document creation.
  • Ver. 1.1 – November 9th, 2000 – Testing Danfoss CALSTREEM.
  • Ver. 1.2 – December 14th, 2000 – Change of the outputs AUX1 and AUX2 from Ci to Ai
  • Ver. 1.3 - November 22nd, 2005 - Redesigned by M-Bus Rev. 4.8.
  • Ver. 1.4 - March 10th, 2021 - Added "Accept Reply To Broadcast" parameter
  • Ver. 1.5 - June 14, 2024 - Support fro writing

Write a comment...