M-Bus

What is M-Bus?

M-Bus (Meter-Bus) is a European communication protocol, defined in the EN 13757 series of standards, that lets a central master remotely read consumption meters for gas, water, electricity and heat over a simple two-wire bus or by radio (Wireless M-Bus). It was developed in 1992 by Horst Ziegler of the University of Paderborn together with Texas Instruments Deutschland and Techem. It was first described in EN 1434 for heat meters and later received its own series of standards. Today M-Bus is the standard for sub-metering, building automation and smart meters across Europe, including the Netherlands, where in modern installations the smart gas meter talks to the electricity meter over Wireless M-Bus.

🧠 How does wired M-Bus work?

Wired M-Bus (EN 13757-2) is a two-wire bus with a master/slave architecture. A single master, often a level converter or data logger, polls the meters (slaves) one at a time. A slave never transmits on its own initiative. The physical layer is cleverly designed:

• Master to slave by voltage - a logical 1 (mark) is nominally +36 V, a logical 0 (space) is about 12 V lower, around +24 V.
• Slave to master by current - at rest a slave draws at most 1.5 mA per unit load. To send a 0 it draws an extra 11 to 20 mA, which the master detects.
• Bus powering - the quiescent current can power the interface and sometimes the whole meter. A battery takes over if the bus fails.
• Polarity independent - the two wires may be swapped, which prevents installation errors.
• Free topology - line, star or tree on ordinary telephone cable (for example J-Y(St)Y 2×0.8 mm).

The EN 13757 series splits the protocol across several parts:

The data link layer uses the FT 1.2 frame format from the telecontrol world, with 8 data bits, even parity and one stop bit (8E1), half duplex. 2400 baud is the most common speed. That is slow compared with Modbus RTU on RS-485, but more than enough for meters read once every quarter of an hour or once an hour.

🔧 Which frames and addresses does M-Bus use?

The secondary address consists of the meter’s serial number, a manufacturer code, a version and the medium (gas, water, heat, electricity). This lets you address meters without first assigning a primary address by hand. Measured values sit in the application layer (EN 13757-3) as records with a DIF (data type and length) and a VIF (unit and scale), so a master knows without vendor-specific drivers that a value is, for example, 1234.567 m³.

📡 What is Wireless M-Bus?

Wireless M-Bus (EN 13757-4) takes the same application layer to radio. Battery-powered meters transmit a telegram periodically and sleep the rest of the time, so a battery lasts ten years or more. A receiver, gateway or drive-by reading vehicle picks up the telegrams.

The 868 MHz modes sit in the European SRD band of 868–870 MHz, where strict duty-cycle limits apply. Compared with LoRaWAN and NB-IoT, which offer longer range, Wireless M-Bus needs no network subscription or operator and is the established standard for metering. EN 13757-5 describes relaying via repeaters. In practice gateways convert the telegrams to MQTT, Modbus TCP or BACnet for the BMS, or forward them to IoT and cloud platforms.

🔐 How secure is M-Bus?

M-Bus was designed for reliability, not for security. Wired installations usually run unencrypted in practice, and anyone with physical access to the bus can eavesdrop or inject frames. Wireless raises the risk: telegrams can be received from hundreds of metres up to a few kilometres away. Security research presented at Black Hat in 2013 showed that many Wireless M-Bus implementations used weak encryption or none at all.

Security is defined in EN 13757-7 (transport and security services, 2018 edition, revised in 2025) and in the Open Metering System (OMS) specification, which makes M-Bus meters from different manufacturers interchangeable:

Practical measures for your installation:

• Choose at least mode 7 or mode 9 for new meters and manage AES keys per meter, not one key for the whole building.
• Watch out for replay attacks - check that the receiver validates the message counter (access number) and timestamp.
• Isolate the bus and gateways with network segmentation in their own zone, following the zones and conduits model of IEC 62443.
• Apply defence in depth at every link between the metering network and IT/OT networks: multiple layers, no direct route from the internet to the bus.
• Add meters and gateways to your asset inventory and your patch policy: the IP side of the gateway is precisely the attack path.

🏭 Where is M-Bus used in practice?

• Sub-metering in buildings - heat and water meters per apartment or tenant, with a central master per building linked through a gateway to the BMS or SCADA.
• Smart meters in the Netherlands - under the DSMR/ESMR5 requirements, the smart gas meter communicates with the electricity meter over Wireless M-Bus at 868 MHz. Depending on the mode it sends a reading every hour or every five minutes, which you can read out through the P1 port.
• District heating and water utilities - drive-by or fixed networks that read thousands of meters without knocking on a door.
• Industrial energy management - kWh, gas and steam meters per production line as input for ISO 50001, a historian or the MES.

The European Energy Efficiency Directive has required since 25 October 2020 that newly installed heat meters and heat cost allocators be remotely readable. Existing devices must be upgraded or replaced by 1 January 2027, unless that is shown not to be cost-efficient. This is a strong driver for Wireless M-Bus.

🧭 How do you integrate M-Bus step by step?

1. Inventory the meters - type, medium, wired or wireless, primary and secondary address, and security mode.
2. Size the bus - at most 250 slaves per master in the standard configuration, a slave up to about 350 m from the master or repeater and about 1,000 m of cable in total. Spread larger installations over several level converters.
3. Choose the master or gateway - with export to Modbus TCP, BACnet, OPC UA or MQTT, depending on your BMS or edge platform.
4. Set a sensible polling cycle - at 2400 baud a full scan of hundreds of meters easily takes minutes, so choose 15 or 60 minutes rather than seconds.
5. Manage keys securely - receive AES keys per meter from the supplier over a secure channel and do not store them in plain text on the gateway.
6. Segment and monitor - place the gateway behind a firewall and track unusual traffic with security monitoring.

❓ Frequently asked questions

What is the difference between M-Bus and Modbus?

M-Bus is designed specifically for reading consumption meters and powers the slaves over the bus, whereas Modbus is a general-purpose industrial protocol for PLCs and field devices. M-Bus carries standardised units in the data (VIF), while Modbus only has registers without built-in meaning. Gateways often translate M-Bus into Modbus TCP to connect meters to a BMS.

How many meters can be connected to one M-Bus?

One M-Bus master supports at most 250 meters with a primary address, the range 1 to 250. In practice cable length and bus power also limit the number. Larger installations use several level converters or repeaters.

What is the difference between M-Bus and Wireless M-Bus?

M-Bus uses a two-wire bus according to EN 13757-2, while Wireless M-Bus uses a radio link according to EN 13757-4, usually at 868 MHz. Both share the same application layer (EN 13757-3), so measured values are encoded in the same way. Wireless M-Bus is popular wherever cabling is too expensive or impractical.

Is Wireless M-Bus encrypted?

Wireless M-Bus supports AES-128 encryption through EN 13757-7 and the OMS specification, with modes 5, 7 and 9 as the common variants. Mode 5 with a static key is the most widespread but also the weakest. New projects are better off choosing mode 7 or mode 9 with authentication.

Does the Dutch smart meter use M-Bus?

The Dutch smart meter uses Wireless M-Bus at 868 MHz for the link between the gas meter and the electricity meter, following the DSMR/ESMR requirements of the grid operators. The electricity meter then forwards the gas reading to the grid operator and shows it on the P1 port.

How fast is M-Bus?

Wired M-Bus runs at 300 to 9600 baud, with 2400 baud the most common. This low speed makes long cables and bus powering possible. For meters read every quarter of an hour or every hour, that is more than sufficient.

📌 In summary

M-Bus is the European standard (EN 13757) for reading consumption meters remotely, wired or wireless, with a simple bus-powered two-wire connection and a radio variant that usually runs at 868 MHz. The protocol connects meters in buildings, district heating networks and factories to BMS, SCADA and energy management. Because M-Bus originally offered little security, choose modern security modes, per-meter key management and a segmented gateway.