1.2 IEC 62056 Standard Suite & Colored Books Map

Reference map correlating the DLMS UA Colored Books with official IEC, ANSI, and EN international standards.

1. The DLMS UA "Colored Books" System

The DLMS User Association publishes the core specifications, commonly categorized by book color:

2. IEC 62056 Standards Breakdown

1.3 Client/Server Logical Architecture & SAP Addressing

How physical meters partition into Logical Devices, Server SAPs, and role-based Client SAP access points.

1. Logical Devices & Server SAP

A single physical meter can host multiple Logical Devices (LD), each identified by a unique Server SAP (Service Access Point):

2. Client SAP Hierarchy & Permissions

Clients connect to the meter using assigned Client SAP addresses representing security roles:

Client SAP 0x0010 (16): Public Client     ───► No Encryption, Basic Read (LDN, IC)
Client SAP 0x0001 (1) : Management Client  ───► HLS 5 GMAC, Full Configuration & Relay Trip
Client SAP 0x0002 (2) : Firmware Upgrade   ───► Image Transfer (Class 18)
Client SAP 0x0003 (3) : Utility Reader     ───► Tariff Read & Billing Data Export

3. Addressing Rules in HDLC vs TCP Wrapper

2.1 IEC 62056-46 HDLC Link Layer & Frame Format Type 3

In-depth dissection of HDLC Frame Format Type 3 structure, MAC addressing, dual CRC-16 checksums, and link state management.

1. HDLC Frame Format Type 3 Structure

A standard DLMS HDLC frame is delimited by opening and closing 0x7E flag bytes:

┌──────┬──────────────────────┬──────────┬──────────┬─────────┬────────┬───────────────────┬────────┬──────┐
│ Flag │ Format & Length (2B) │ Dest MAC │ Src MAC  │ Control │  HCS   │ Information Field │  FCS   │ Flag │
│ 0x7E │ Type 3 / S-Bit / Len │ (1-4 B)  │ (1-4 B)  │ (1 B)   │ (2 B)  │ (LLC + xDLMS APDU)│ (2 B)  │ 0x7E │
└──────┴──────────────────────┴──────────┴──────────┴─────────┴────────┴───────────────────┴────────┴──────┘

2. Interactive HDLC Frame Dissection

SNRM (Set Normal Response Mode) Frame:

7E A0 0A 00 02 00 23 03 93 9A FB 7E

3. HDLC Control Commands Table

2.2 IEC 62056-47 TCP/UDP Port 4059 Wrapper Profile

Protocol specification for the lightweight 8-byte TCP/UDP Wrapper header used over IP networks and cellular IoT.

1. The 8-Byte Wrapper Header

Unlike HDLC, the IP transport profile (IEC 62056-47) eliminates flag bytes, bit stuffing, and CRC checks (relying on TCP checksums) and prefixes all APDUs with an 8-byte Wrapper Header:

┌─────────────────┬─────────────────┬─────────────────┬─────────────────┐
│  Protocol Ver   │   Source WPort  │ Destination WPort│   Length (2B)   │
│  0x00 0x01 (2B) │  Client SAP(2B) │  Server SAP(2B) │ APDU Length(2B) │
└─────────────────┴─────────────────┴─────────────────┴─────────────────┘

2. Interactive Frame Example

Wrapper GET Request on Management Client:

00 01 00 01 00 01 00 0D C0 01 C1 00 01 00 00 01 00 00 FF 02 00

3. TCP Keep-Alive & Long Connections

2.3 IEC 62056-21 Optical Probe & Mode E Baud Rate Adaptation

How handheld units and optical probes execute initial sign-on at 300 baud and switch to high-speed HDLC at 9600/19200 baud.

1. Sign-on Sequence & Baud Switching

Under IEC 62056-21 Mode E, optical communication starts at 300 baud (7E1) and transitions to high-speed DLMS HDLC:

Handheld Unit (HHU)                                Meter (Server)
      │                                                  │
      │─── /?!<CR><LF> (300 Baud Sign-On) ──────────────►│
      │                                                  │
      │◄── /LOG5\2ZMD410...<CR><LF> (Identification) ────│
      │                                                  │
      │─── <ACK>050<CR><LF> (Mode E Handshake) ─────────►│
      │                                                  │
   [Switch to 9600 / 19200 Baud, 8N1 HDLC Framing]       │
      │                                                  │
      │─── 7E A0 0A 00 02 00 23 03 93 9A FB 7E (SNRM) ──►│
      │◄── 7E A0 1F 03 00 02 00 23 73 ... 7E (UA) ──────│

2. Mode E Protocol Parameter Breakdown

2.4 HDLC Frame Segmentation & Two-Tier CRC-16 Checksum State Machine

The mechanics of S-bit link-layer fragmentation, LLC sublayer positioning, CRC-16 CCITT validation, and full buffer reassembly before deciphering.

1. Segmentation Bit (S-Bit) & LLC Positioning

Per IEC 62056-46 Section 6.4.4.4.3: - When an APDU exceeds the maximum frame length, HDLC splits it across multiple frames. - Format Type 3 Byte 2 Bit 11 is the S-bit (0xA8 for segmented, 0xA0 for final/unsegmented). - LLC Sublayer (0xE6 0xE6 0x00) is included ONLY in Segment 1. Continuation segments contain raw payload bytes immediately following the Control field!

Segment 1 (S=1): [7E] [A8 84] [Dest] [Src] [Ctrl] [HCS] [E6 E6 00] [Ciphertext Part 1] [FCS] [7E]
Segment 2 (S=1): [7E] [A8 80] [Dest] [Src] [Ctrl] [HCS]          [Ciphertext Part 2] [FCS] [7E]
Segment 3 (S=0): [7E] [A0 42] [Dest] [Src] [Ctrl] [HCS]          [Ciphertext Part 3 + Tag] [FCS] [7E]

2. Golden Rule of DLMS Decryption

3.1 OBIS Identification System & 6-Group (A-F) Structure

The universal 6-group (A.B.C.D.E.F) hierarchical naming convention defined in the DLMS Blue Book and IEC 62056-61.

1. OBIS Group Architecture

Every physical or logical quantity in DLMS is addressed by a 6-tuple: A.B.C.D.E.F:

2. Common OBIS Examples

3.2 Electricity OBIS Code Registry & Multi-Tariff Models

Authoritative registry of standard electricity measurement OBIS codes across single-phase and polyphase smart meters.

1. Active & Reactive Energy Registry

2. Instantaneous Grid Quality Telemetry

3.3 Class 3/4 Registers & Signed 8-Bit Negative Scaler Parsing

How to decode Class 3/4 ScalerUnit structures, parse signed 8-bit negative exponents (-3), and prevent floating point precision loss.

1. Register Interface Class (Class 3 & 4)

Per DLMS Blue Book Section 4.3.3, Class 3 contains: - Attribute 2 (value): Measurement quantity (integer/long/double-long) - Attribute 3 (scaler_unit): Structure containing: - scaler: Integer8 (Tag 0x0F) — SIGNED 8-bit integer! - unit: Enum (Tag 0x16)

2. The Negative Scaler Decoding Trap

3. High Cumulative Energy & Float32 Rounding Trap

3.4 Class 7 Profile Generic Load Buffers & Selective Access

Architecture of load profile circular buffers, capture objects definition, and time-range vs entry-index selective filtering.

1. Profile Generic (Class 7) Architecture

Class 7 manages periodic interval capture (e.g. 15-minute load profiles, daily billing profiles): - Attribute 2 (buffer): Two-dimensional table of captured records. - Attribute 3 (capture_objects): Array of column descriptors (Class ID, OBIS, Attribute ID). - Attribute 4 (capture_period): Interval in seconds (e.g. 900 for 15 min).

2. Selective Access Selector 1 (By Date Range)

SelectiveAccessDescriptor ::= Structure {
  access_selector: 1 (RangeDescriptor),
  access_parameters: Structure {
    restricting_object: Structure { class_id: 8, obis: 0.0.1.0.0.255, attribute_id: 2 },
    from_value: Date_Time ("2026-08-01 00:00:00"),
    to_value:   Date_Time ("2026-08-01 23:59:59"),
    selected_values: Array [] // Empty array = all columns
  }
}

3.5 Class 8 Clock RTC 12-Byte Octet-String & DST Drift Mitigation

The precise 12-byte date_time octet-string layout, timezone deviation offsets, daylight saving status masks, and clock synchronization.

1. The 12-Byte Date_Time Structure

Per DLMS Blue Book Section 4.1.6.1, the standard timestamp is a 12-byte Octet-String:

3.6 Class 70 Disconnect Control & Remote Tripping Safety

Operating internal meter load disconnect switches safely via Class 70 methods, control states, and lockout protections.

1. Disconnect Control (Class 70) Attributes

2. Remote Disconnect / Reconnect Methods

3.7 Class 20/22 Schedules & Safe Distant Epoch Anchoring

Why using 0xFF wildcards triggers continuous 1Hz execution loops, why 01 00 empty arrays fail on legacy firmware, and why 2099/2100 is the universal standard.

1. Schedule Execution Time Traps

2. The Universal Golden Standard (Year 2099/2100)

09 0C 08 33 0C 1F FF 17 3B 3B 00 80 00 00

3.8 A-XDR BER Tag Encoding Directory & Data Structure Trees

Complete catalog of A-XDR compact primitive type tags, ASN.1 structures, length octet encodings, and nested data parsing.

1. Standard A-XDR Type Tags Directory

4.1 ACSE Association Lifecycle (AARQ 0x60 / AARE 0x61 / RLRQ / ABRT)

State machine and ASN.1 handshake exchange for Association Request (AARQ), Response (AARE), Release (RLRQ), and Abort (ABRT).

1. ACSE Association Exchange

Client (HES)                                     Meter (Server)
    │                                                   │
    │─── AARQ (0x60) [App Context, System Title, CtoS] ─►│
    │                                                   │
    │◄── AARE (0x61) [Result: 00, System Title, StoC] ──│
    │                                                   │
    │─── Action-Request (Method 1: CtoS GMAC Tag) ──────►│
    │                                                   │
    │◄── Action-Response (Method 1: Server Proof Tag) ──│
    │                                                   │
    │========= Associated (Authorized Channel) =========│
    │                                                   │
    │─── RLRQ (0x62) [Release Request] ────────────────►│
    │◄── RLRE (0x63) [Release Response] ────────────────│

2. AARQ APDU Dissection

4.2 Security Suites 0, 1 & 2 Cryptographic Matrix

Comparative cryptographic profile across DLMS Security Suite 0 (legacy), Suite 1 (AES-128 + ECC P-256), and Suite 2 (AES-256 + P-384).

1. Cryptographic Algorithms Comparison

4.3 HLS 5 (GMAC) Challenge-Response Mutual Authentication & Table 43 Vectors

Bidirectional challenge calculation, Client/Server System Title orientation, and Green Book Table 43 official verification vectors.

1. HLS 5 Challenge-Response Formula

$$\text{CtoS Tag} = \text_{\text}(\text \parallel IC_{\text}, \text_{\text}, \text)$$ $$\text{StoC Tag (Server Proof)} = \text_{\text}(\text \parallel IC_{\text}, \text_{\text}, \text)$$

2. Official Green Book Table 43 Standard Vector

10 00 00 00 01 1A 52 FE 7D D3 E7 27 48 97 3C 1E 28

4.4 General-Glo-Ciphering (0xDB) & Security Control Byte Bitmasks

Deconstructing the 0xDB encrypted APDU envelope, Security Control bitmasks, IV assembly, and AAD formulation.

1. Structure of General-Glo-Ciphering (0xDB)

┌──────┬────────┬──────────────┬────────┬────────────────┬──────────────────────────┬──────────┐
│ Tag  │ Length │ System Title │ SC (1B)│ Invocation Cnt │ Ciphertext Stream (AES)  │ GMAC Tag │
│ 0xDB │  0x08  │   (8 Bytes)  │  0x30  │   (4 Bytes)    │ (Encrypted xDLMS APDU)   │ (12 B)   │
└──────┴────────┴──────────────┴────────┴────────────────┴──────────────────────────┴──────────┘

2. Security Control Byte (SC) Bitmask

Common SC values: - 0x10: Global Key, Authenticated Only - 0x30: Global Key, Authenticated & Encrypted (Standard Production Mode)

4.5 Invocation Counter ($IC$) Non-Volatile Persistence & Cold-Start Sync

How non-volatile storage in smart meters enforces anti-replay policies across TCP teardowns and how HES pre-reads IC via Public Client.

1. The Monotonic IC Invariant

2. Cold-Start Synchronization Procedure

4.6 Association LN Access Control Matrix & Object Access Modes

Why authenticated HLS 5 associations fail with scope-of-access-violated when reading Class 70 or Class 8 without PDU-level encryption.

1. Object Access Modes in Association LN

Per DLMS Blue Book Section 4.5.3, Attribute 2 of 0.0.40.0.0.255 defines per-object permissions: - 1: read_only (Plaintext allowed) - 3: read_and_write - 4: authenticated_read - 5: authenticated_and_encrypted_read

If Clock (Class 8) or Relay (Class 70) is configured with Mode 5, sending a plain Get-Request results in scope-of-access-violated (0xC4 0x01 C1 01 01). The request must be wrapped inside 0xDB ciphering.

5.1 xDLMS DataBlock-G vs GBT (General Block Transfer) Streaming

Comparing traditional stop-and-wait datablocks with General Block Transfer (GBT) streaming windows, and resolving AARQ Bit 19 negotiation deadlocks.

1. DataBlock-G vs GBT

2. Conformance Bit 19 Rule

5.2 Class 18 Image Transfer Firmware OTA Upgrade & Signature Verification

Complete OTA firmware upgrade lifecycle: initiation, zero-indexed block transfer, bitstring tracking, ECDSA signature formats, and activation.

1. The 4-Step Image Transfer Lifecycle

Per DLMS Blue Book Section 4.3.8 (0.0.44.0.0.255): 1. Method 1 (image_initiate): Pass image identifier (e.g. "V3.2.0") and image size in bytes; 2. Method 2 (image_block_transfer): Send blocks sequentially starting at block_number = 0; 3. Method 3 (image_verify): Submit digital signature (ASN.1 DER encoded ECDSA P-256); 4. Method 4 (image_activate): Execute firmware flash and reboot.

5.3 Class 40 (Push Setup) Unsolicited Event Notification & Backoff

Configuring unsolicited alarm pushes (power outage, tamper detection) over TCP/UDP and managing randomized backoff retry intervals.

1. Push Setup (Class 40) Configuration

6.1 Open-Source SDK Integration Guide (Gurux.DLMS / Python / C)

Step-by-step developer guide for connecting to smart meters using Gurux.DLMS in Python, ANSI C, and Java.

1. Python Gurux.DLMS Quickstart

from gurux_dlms.secure import GXDLMSSecureClient
from gurux_dlms.enums import Authentication, Security, InterfaceType
from gurux_dlms.objects import GXDLMSClock
client = GXDLMSSecureClient(True, 1, 1, Authentication.HIGH_GMAC, None, InterfaceType.WRAPPER)
client.ciphering.systemTitle = bytes.fromhex("4D4D4D0000000001")
client.ciphering.authenticationKey = bytes.fromhex("D0D1D2D3D4D5D6D7D8D9DADBDCDDDEDF")
client.ciphering.blockCipherKey = bytes.fromhex("000102030405060708090A0B0C0D0E0F")
client.ciphering.security = Security.AUTHENTICATION_ENCRYPTION
# Ready to generate AARQ and exchange messages

6.2 Top 10 DLMS Engineering Traps & Diagnostic Fault Tree

Comprehensive diagnostic fault tree resolving the 10 most common DLMS engineering failures in lab and field deployments.

1. Top 10 Diagnostic Fault Matrix

3.0 COSEM Interface Classes & Object Architecture

Fundamental object-oriented architecture of COSEM Interface Classes defined in IEC 62056-62 and Blue Book.

1. COSEM Interface Classes Hierarchy

4.0 AARQ Handshake & Security Suites 0/1/2 Overview

Application Association Request (AARQ) parameters, High Level Security (HLS 5 GMAC), and ciphering suites.

1. Association & Security Parameters

6.0 Official Standards, CTT & Open-Source SDKs

Official standards portals, DLMS UA testing tools, and open-source protocol libraries.

1. Official Standards & Conformance Links