Overview
When querying Class 3 (Register) object 1.0.32.7.0.255 (Phase A Instantaneous Voltage), our data collector parsed a raw voltage value of 2200 with scaler 0xFF and produced a catastrophic measurement reading: 2200000000000000000000 V (2.2 x 10^27 V).
DLMS APDU Response Trace
C4 01 C1 00 00 02 02 12 08 98 02 02 0F FF 16 23
ASN.1 Type Dissection
C4 01 C1:GET-Response-Normal(Invoke-Id-And-PriorityC1)00 00: Data-Access-Resultsuccess(0)02 02: Structure of 2 elements12 08 98: Element 1 ->double-long-unsigned(Value = 2200 /0x0898)02 02: Element 2 -> Structure of 2 elements (Scaler_Unit_Type)0F FF: Scaler ->Integer8(0xFF)16 23: Unit ->enum(35 =0x23= VoltsV)
Root Cause
Per DLMS Blue Book Section 4.3.3, the scaler field is of type Integer8 (signed 8-bit integer) in two's complement representation.
0xFF=-1(Scaling factor is $10^{-1} = 0.1$)- Correct calculation: $2200 \times 10^{-1} = 220.0\text{ V}$
- The bug: The parsing library treated
0xFFasuint8_t(255), evaluating $2200 \times 10^{255}$ and overflowing database decimal columns!