WMBus Module
868 MHz Wireless M-Bus (WMBus) radio
Link Budget
Up to 130 dB
Communication Distance
Up to 3 km in line of sight; typically about 100 m indoor and urban
Reception Mode
Rx Package Reception Mode: S - Mode, T - Mode or C / T - Mode ( combined reception of T and C Mode messages ); factory default T - Mode
Transmission Mode
Tx Package Transmission Mode: S - Mode, Packet Format A; T - Mode, Packet Format A; C - Mode, 50.000 or 100.000 bps, Format A or Format B; used by the transparent gateway and repeater functions
Supported CI Values
53h, 5Bh, 60h, 6Ch, 6Dh, 6Eh, 6Fh, 72h, 74h, 75h, 78h, 7Ah, 7Ch, 7Dh, 80h, 8Ah, 8Bh, 8Ch, 8Dh, 8Eh, 8Fh, C3h, C4h, C5h
Decryption
AES-128 in security mode 5 (AES-128 CBC), mode 7 (AES-128 CBC with dynamic key) and mode 128 (ELL AES-128 counter mode), up to 20 meters
Meters that send unencrypted records after the encrypted part of a mode 5 telegram are delivered complete, without any setting (from the next restart if the key was entered before the meter was first heard).
Parsing
Decrypted WMBus data can be parsed based on WMBus OMS
Data type codes 1 - 65; the gateway keeps up to 14 records per telegram.
Auto Configuration
The gateway lists the meters it hears with their signal strength; Refresh Auto Config List adds them to the AES-128 Decryption List.
Key Entry
Keys can be typed, imported from a CSV file or a Kamstrup KEM file, applied to several rows at once, or given to new meters by two key rules.
Transparent Functions
Receiving WMBus frames can be turned off if not used. Any number of meters is passed on to the TCP clients or the serial device; meters whose AES key is entered (up to 20) are passed on decrypted.
Output Power Level
-1 dBm to 13 dBm in steps of 1 dBm, used when the gateway sends telegrams (transparent gateway and repeater functions)

Ethernet Standards 
IEEE 802.3 for 10Base-T
IEEE 802.3u for 100Base-T(X)
IEEE 802.3x Flow Control
Mac Table 
1K MAC address entry
Processing 
Store-and-Forward
Memory 
448K bits packet buffer memory

After every start the device asks the time server.
The device clock is then compared with the NTP time once an hour and set to the NTP time when it differs by 5 seconds or more; the correction does not restart the device.
If the time server does not answer, a time that was set by hand on the Management page stays as it is.
The clock runs in UTC; there is no time zone setting.
The device has no battery for the clock: after a power cut the time is set again from the NTP server or with Set Device Time.

Modbus Protocol
Modbus TCP or Modbus RTU, selected with the Device Function
Modbus Devices
Modbus TCP: up to 10 clients at the same time (factory 2), port 502 by default. Modbus RTU: one master on the RS485 port.
Modbus Address
Every meter is a separate Modbus slave; address 1 to 247, up to 20 meters
Modbus Data
Function 03 (Read Holding Registers), starting at address 0
Data Structure
Header, 6 registers: device ID (2), manufacturer ID, version, device type, record count n. One block of 5 registers per record: storage number, function field, data type, value (2 registers). Tail, 4 registers: access number, RSSI, meter status byte, decryption status
Values
FLOAT32 scaled to the unit of the data type (high word first), or the raw 4 bytes of the meter
Map Length
A full read is 10 + 5 x n registers; the longest map is 80 registers. A read past the end of the map is answered, the registers past the end are 0.
Decryption Status
0 not encrypted, 1 decrypted, 2 no key, 3 mode not supported, 4 key might be wrong

MQTT Publisher
In the Modbus TCP and Modbus RTU gateway functions MQTT publishing can be switched on next to the Modbus service; in the WMBus Decoder/Parser and MQTT Publisher function it is always on. Up to 20 meters are published.
MQTT Connection
Broker IP address or host name and port; Client ID, user name and password (always sent). MQTT 3.1.1 over TCP, not encrypted: encrypted MQTT (TLS) is not supported.
Topics
Publish Topic for the meter data; Subscribe Topic for a configuration file sent over MQTT
Minimum Send Interval for a Parsed Data (in seconds)
Shortest time between two messages of the same meter, 1 to 65535 seconds, factory default 60
Time Stamps
Send time and receive time (seconds since 1970, UTC) while the device has a current time from the NTP server
Data Format
RAW WMBUS DECRYPTED DATA, PARSED DATA AS OBJECTS or PARSED DATA AS MODBUS FRAME
Throughput
About 3 messages per second

SMA Antenna Connector
SMA female, 50 ohm
10/100T(X) RJ45 Port
1 x 10/100Base-T(X) Ethernet port
Serial Port
Terminal block for RS485: A and B
Console Port
No console port; the log is available over UDP.
Reset Button
RESET TO SERVER: held for more than 5 seconds, it restores the factory settings and restarts the device

Ethernet
Ethernet activity LED
Device
STATUS: in the device functions with a TCP server it blinks while no client is connected and stays on while a client is connected; in the serial device functions it stays on. Tx and Rx blink when data is sent and received. SERVER: on in the two device functions with a TCP server (WMBus - TCP/IP Transparent Gateway and WMBus - Modbus TCP Gateway (and MQTT Publisher)), off in the others.
WMBus
ALIVE blinks during normal operation; Tx and Rx blink when telegrams are sent and received

Input Range
9 - 36 V DC (40 V maximum)
Protection
Reverse polarity; insulation 1500 V DC for 1 minute, leakage < 1 mA

Enclosure
Metal, IP 40
Dimensions
43 x 95 x 124 mm (w x d x h)
Weight
approx. 400 g
Storage Temperature
-55 to 125 C
Operating Temperature
-40 to 85 C
Operating Humidity
5% to 95%, non-condensing