IEC 62056-3-1:2021

IEC 62056-3-1 ®
Edition 2.0 2021-07
REDLINE VERSION
INTERNATIONAL
STANDARD
colour
inside
Electricity metering data exchange – The DLMS/COSEM suite –
Part 3-1: Use of local area networks on twisted pair with carrier signalling

All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé info@iec.ch
CH-1211 Geneva 20 www.iec.ch
Switzerland
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigendum or an amendment might have been published.

IEC publications search - webstore.iec.ch/advsearchform IEC online collection - oc.iec.ch
The advanced search enables to find IEC publications by a Discover our powerful search engine and read freely all the
variety of criteria (reference number, text, technical publications previews. With a subscription you will always
committee, …). It also gives information on projects, replaced have access to up to date content tailored to your needs.
and withdrawn publications.
Electropedia - www.electropedia.org
IEC Just Published - webstore.iec.ch/justpublished
The world's leading online dictionary on electrotechnology,
Stay up to date on all new IEC publications. Just Published
containing more than 22 000 terminological entries in English
details all new publications released. Available online and
and French, with equivalent terms in 18 additional languages.
once a month by email.
Also known as the International Electrotechnical Vocabulary

(IEV) online.
IEC Customer Service Centre - webstore.iec.ch/csc

If you wish to give us your feedback on this publication or
need further assistance, please contact the Customer Service
Centre: sales@iec.ch.
IEC 62056-3-1 ®
Edition 2.0 2021-07
REDLINE VERSION
INTERNATIONAL
STANDARD
colour
inside
Electricity metering data exchange – The DLMS/COSEM suite –
Part 3-1: Use of local area networks on twisted pair with carrier signalling
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
ICS 17.220.20; 35.110; 91.140.50 ISBN 978-2-8322-5174-4

– 2 – IEC 62056-3-1:2021 RLV © IEC 2021
CONTENTS
FOREWORD . 6
1 Scope . 8
2 Normative references . 8
3 Terms, definitions and abbreviated terms . 9
3.1 Terms and definitions. 9
3.2 Abbreviated terms . 9
4 General description . 10
4.1 Basic vocabulary . 10
4.2 Profiles, layers and protocols . 11
4.3 Specification language . 12
4.4 Communication services for local bus data exchange without DLMS . 12
4.5 Communication services for local bus data exchange with DLMS . 21
4.6 Systems management . 22
5 Local bus data exchange without DLMS . 23
5.1 Physical layer . 23
5.2 Data Link layer . 35
5.3 Application layer . 43
6 Local bus data exchange with DLMS . 46
6.1 Physical layer . 46
6.2 Data Link layer . 47
6.3 Application layer . 56
7 Local bus data exchange with DLMS/COSEM . 56
7.1 Model . 56
7.2 Physical Layer . 56
7.3 Data Link layer . 68
7.4 Support Manager layer . 77
7.5 Transport Layer . 81
7.6 Application Layer . 85
8 Local bus data exchange – Hardware . 86
8.1 General . 86
8.2 General characteristics . 86
8.3 Bus specification . 91
8.4 Magnetic plug . 93
8.5 Functional specifications of Primary Station transmitter (for 50 kHz signal) . 95
8.6 Functional specifications of Primary Station receiver (for 50 kHz signal) . 96
8.7 Functional specification of Secondary Station transmitter (for 50 kHz signal) . 97
8.8 Functional specifications of Secondary Station receiver (for 50 kHz signal) . 98
9 Unidirectional local data transmission interface . 99
9.1 Introduction . 99
9.2 General description . 99
9.3 Historical TIC . 99
9.4 Standard TIC . 103
9.5 Unidirectional TIC Hardware . 104
Annex A (normative) Specification language . 111
A.1 Vocabulary and operating rules . 111

A.2 Entity and Entity Invocation . 112
Annex B (normative) Timing types and characteristics . 113
B.1 Timing type definition . 113
B.2 Timing measurements and characteristics. 114
Annex C (normative) List of fatal errors . 115
Annex D (normative) Coding the command code field of frames . 116
D.1 Command codes for local bus data exchange (Table D.1) . 116
D.2 Codes of commands for data exchange on the local bus with DLMS or
DLMS/COSEM . 116
Annex E (normative) Principle of the CRC . 118
E.1 General . 118
E.2 Operations on the polynomials . 118
E.3 Check procedure. 118
E.4 Operating parameters . 119
Annex F (normative) Random integer generation for response from forgotten stations . 120
F.1 General . 120
F.2 Criterion for a random integer . 120
F.3 Operating parameters . 120
Annex G (normative) Random number generation for authentication (profile without

DLMS) . 121
Annex H (normative) Systems management implementation . 122
Annex I (informative) Information about exchanges . 123
I.1 Non-energized station session (Figure I.1) . 123
I.2 Remote reading and programming exchanges (Figure I.2) . 124
I.3 Bus initialization frame (Figure I.3). 125
I.4 Forgotten station call exchange (Figure I.4) . 126
Bibliography . 127

Figure 1 – IEC 62056-3-1 communication profiles . 11
Figure 2 – Alarm mechanism . 21
Figure 3 – Exchanges in continuous operation . 25
Figure 4 – Alarm event without any communication in progress . 26
Figure 5 – Alarm event with a communication in progress . 26
Figure 6 – Signal envelope on the bus . 87
Figure 7 – Bus representation . 88
Figure 8 – Power supply characteristics . 88
Figure 9 – States associated to a session: for selected Secondary Station . 89
Figure 10 – States associated to a session: for non-selected Secondary Station. 89
Figure 11 – Simple and multiple Secondary stations . 90
Figure 12 – Equivalent diagram of the test equipment . 92
Figure 13 – Ferrite pot and bobbin . 93
Figure 14 – Associated components of the magnetic plug . 94
Figure 15 – Associated components of the energy supply plug . 95
Figure 16 – Character transmission . 100
Figure 17 – Historical TIC: information group structure . 101
Figure 18 – Standard TIC: Application information group structure . 103

– 4 – IEC 62056-3-1:2021 RLV © IEC 2021
Figure 19 – Standard TIC: Timestamped information group structure . 103
Figure 20 – Equivalent diagram of the test equipment . 107
Figure 21 – Signal envelope on the bus . 108
Figure B.1 – Logical timing type . 113
Figure B.2 – Physical timing type . 113
Figure B.3 – Results processing for timing defined with low and high limits . 114
Figure B.4 – Results processing for timing defined by a nominal value . 114
Figure I.1 – Non-energized station session . 123
Figure I.2 – Remote reading and programming exchanges . 124
Figure I.3 – Bus initialization . 125
Figure I.4 – Forgotten station call exchange. 126

Table 1 – Primary Station timing . 24
Table 2 – Secondary Station timing . 25
Table 3 – Physical services and service primitives . 26
Table 4 – Physical-62056-3-1 state transitions: Primary Station . 27
Table 5 – Power supply management state transitions (only for non-energized
Secondary Station) . 30
Table 6 – Physical-62056-3-1 state transitions: Secondary Station . 31
Table 7 – Meaning of the states listed in the previous tables. 32
Table 8 – Definition of the procedures, functions and events classified in alphabetical

order . 33
Table 9 – Error summary table . 35
Table 10 – Data Link services and service primitives . 36
Table 11 – Link-62056-3-1 state transitions: Primary Station . 37
Table 12 – Link-62056-3-1 State transitions: Secondary Station . 40
Table 13 – Meaning of the states listed in the previous tables . 41
Table 14 – Definition of the procedures and functions classified in alphabetical order . 41
Table 15 – Error summary table . 42
Table 16 – Application services and service primitives . 43
Table 17 – Application-62056-3-1 state transitions: Primary Station . 44
Table 18 – Application-62056-3-1 state transitions: Secondary Station . 45
Table 19 – Meaning of the states listed in the previous tables . 45
Table 20 – Definition of the procedures and functions classified in alphabetical order . 46
Table 21 – Error summary table . 46
Table 22 – Data Link services and service primitives . 48
Table 23 – Link-E/D state transitions: Primary Station . 49
Table 24 – Link-E/D state transitions: Secondary Station . 51
Table 25 – Meaning of the states listed in the previous tables . 53
Table 26 – Definition of the procedures and functions classified in alphabetical order . 54
Table 27 – Error summary table . 55
Table 28 – Client_connect function definition . 56
Table 29 – E/COSEM Physical services and service primitives . 57
Table 30 – E/COSEM Physical state transitions: Primary Station . 59

Table 31 – Power supply management state transitions (only for non-energized
Secondary Station) . 61
Table 32 – E/COSEM Physical State transitions: Secondary Station . 63
Table 33 – Meaning of the states listed in the previous tables . 64
Table 34 – Definition of the procedures, functions and events classified in alphabetical

order . 65
Table 35 – Error summary table . 68
Table 36 – Data Link services and service primitives . 69
Table 37 – DLMS/COSEM Data Link E/D state transitions: Primary Station. 71
Table 38 – DLMS/COSEM Link E/D state transitions: Secondary Station . 73
Table 39 – Meaning of the states listed in the previous tables . 75
Table 40 – Definition of the procedures and functions classified in alphabetical order . 76
Table 41 – Commands managed by the Support Manager layer . 77
Table 42 – List of parameters . 79
Table 43 – Support Manager layer state transitions: Primary Station. 79
Table 44 – Support Manager layer state transitions: Secondary Station . 80
Table 45 – Meaning of the states listed in the previous table . 80
Table 46 – Definition of procedures, functions and events . 80
Table 47 – Transport services and services primitive . 82
Table 48 – Transport state transitions . 82
Table 49 – Meaning of the states listed in the previous table . 84
Table 50 – Definition of the procedures and functions classified in alphabetical order . 84
Table 51 – Primary station transmitter: Tev0 and Tev1 values . 96
Table 52 – Primary station receiver: Tev0 and Tev1 values . 96
Table 53 – Secondary station transmitter: Tev0 and Tev1 values . 97
Table 54 – Secondary station receiver: Tev0 and Tev1 values . 98
Table 55 – TIC terminal board pin out . 105
Table 56 – Power supply characteristics . 105
Table 57 – Signal characteristics . 107
Table C.1 – FatalError error numbers . 115
Table D.1 – Command codes for local bus data exchange . 116
Table D.2 – Command codes with DLMS and DLMS/COSEM . 117
Table H.1 – Discovery service . 122
Table H.2 – Service specification . 122

– 6 – IEC 62056-3-1:2021 RLV © IEC 2021
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
ELECTRICITY METERING DATA EXCHANGE –
THE DLMS/COSEM SUITE –
Part 3-1: Use of local area networks on twisted pair
with carrier signalling
FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international
co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and
in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports,
Publicly Available Specifications (PAS) and Guides (hereafter referred to as "IEC Publication(s)"). Their
preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with
may participate in this preparatory work. International, governmental and non-governmental organizations liaising
with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for
Standardization (ISO) in accordance with conditions determined by agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence between
any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of patent
rights. IEC shall not be held responsible for identifying any or all such patent rights.
This redline version of the official IEC Standard allows the user to identify the changes made to
the previous edition IEC 62056-3-1:2013. A vertical bar appears in the margin wherever a change
has been made. Additions are in green text, deletions are in strikethrough red text.

International Standard IEC 62056-3-1 has been prepared by IEC technical committee 13:
Electrical energy measurement and control.
This second edition cancels and replaces the first edition of IEC 62056-3-1, issued in 2013, and
constitutes a technical revision.
The main technical changes with regard to the previous edition are as follows:
• addition of a profile which makes use of the IEC 62056 DLMS/COSEM Application layer and
COSEM object model;
• review of the data link layer which is split into two parts:
– a pure Data Link layer;
– a "Support Manager" entity managing the communication media;
• ability to negotiate the communication speed, bringing baud rate up to 9 600 bauds.
The text of this International Standard is based on the following documents:
CDV Report on voting
13/1794/CDV 13/1823/RVC
Full information on the voting for its approval can be found in the report on voting indicated in
the above table.
The language used for the development of this International Standard is English.
This document was drafted in accordance with ISO/IEC Directives, Part 2, and developed in
accordance with ISO/IEC Directives, Part 1 and ISO/IEC Directives, IEC Supplement, available
at www.iec.ch/members_experts/refdocs. The main document types developed by IEC are
described in greater detail at www.iec.ch/standardsdev/publications.
A list of all parts of IEC 62056 series, published under the general title Electricity metering data
exchange – The DLMS/COSEM suite, can be found on the IEC website.
The committee has decided that the contents of this document will remain unchanged until the
stability date indicated on the IEC website under webstore.iec.ch in the data related to the
specific document. At this date, the document will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
IMPORTANT – The 'colour inside' logo on the cover page of this publication indicates that it
contains colours which are considered to be useful for the correct understanding of its
contents. Users should therefore print this document using a colour printer.

– 8 – IEC 62056-3-1:2021 RLV © IEC 2021
ELECTRICITY METERING DATA EXCHANGE –
THE DLMS/COSEM SUITE –
Part 3-1: Use of local area networks on twisted pair
with carrier signalling
1 Scope
This part of IEC 62056 describes three profiles for two sets of profiles: the first set of profiles
allows a bidirectional communication between a client and a server. This set of profiles is made
of three profiles allowing local bus data exchange with stations either energized or not. For non-
energized stations, the bus supplies energy for data exchange. Three different profiles are
supported:
• base profile: this three-layer profile provides remote communication services;
NOTE 1 This first profile was published in IEC 61142:1993 and became known as the Euridis standard.
• profile with DLMS: this profile allows using DLMS services as specified in IEC 61334-4-41;
NOTE 2 This second profile was published in IEC 62056-31:1999.
• profile with DLMS/COSEM: this profile allows using the DLMS/COSEM Application layer and
the COSEM object model as specified in IEC 62056-5-3 and in IEC 62056-6-2 respectively.
The three profiles use the same physical layer and they are fully compatible, meaning that
devices implementing any of these profiles can be operated on the same bus. The transmission
medium is twisted pair using carrier signalling and it is known as the Euridis Bus.
The second set of profiles allows unidirectional communication between a given Energy
Metering device and a Customer Energy Management System. This second set is made up of
three profiles.
Subclause 4.2.1 to Clause 8 included specify the bidirectional communication using twisted pair
signalling and Clause 9 to 9.5 the unidirectional communication using twisted pair signalling.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies.
For undated references, the latest edition of the referenced document (including any
amendments) applies.
IEC 61334-4-41:1996, Distribution automation using distribution line carrier systems – Part 4:
Data communication protocols – Section 41: Application protocols – Distribution line message
specification
IEC 62056-51:1998, Electricity metering – Data exchange for meter reading, tariff and load
control – Part 51: Application layer protocols
IEC 62056-5-3:2017, Electricity metering data exchange – The DLMS/COSEM suite – Part 5-3:
DLMS/COSEM application layer
IEC 62056-6-2:2017, Electricity metering data exchange – The DLMS/COSEM suite – Part 6-2:
COSEM interface classes
ISO/IEC 8482:1993, Information technology – Telecommunications and information exchange
between systems – Twisted pair multipoint interconnections
EIA 485, Standard for Electrical Characteristics of Generators and Receivers for Use in
Balanced Digital Multipoint Systems
3 Terms, definitions and abbreviated terms
3.1 Terms and definitions
No terms and definitions are listed in this document.
ISO and IEC maintain terminological databases for use in standardization at the following
addresses:
• IEC Electropedia: available at http://www.electropedia.org/
• ISO Online browsing platform: available at http://www.iso.org/obp
3.2 Abbreviated terms
ADP Primary Station Address
ADG General Secondary Address. Broadcast Address
ADS Secondary Station Address
AGN Normal Wakeup
AGT General call for a General Energized Station
APDU Application Protocol Data Unit
APG General Primary Address
ARJ COM field value: Rejection of authentication in remote programming exchange
ASDU Application Service Data Unit
ASO COM field value: Call to Forgotten Stations
AUT COM field value: Authentication command
COM Control field of the Data Link layer
COSEM Companion Specification for Energy Metering
DAT COM field value: Response of remote reading exchange
DES Data Encryption Standard
DLMS Distribution Line Message Specification (IEC 61334-4-41)
Device Language Message Specification (IEC 62056-5-3)
DSDU Data link Service Data Unit
DRJ COM field value: Data Rejected
Value of COM notifying the rejection of remote programming exchange data
Dsap Transport data unit label. Coded over 3 bits. Its value is 6.
DTSAP Destination of Transport Service Access Point
ECH COM field value: Echo of remote programming exchange data
ENQ Remote reading exchange request
EOS COM field value: End of remote programming exchange
IB Initialisation of the bus
LDTI Local Data Transmission Interface
MaxRetry Maximum number retransmissions. Limited to 2.
MaxRSO Maximum number of RSO listening windows. Fixed at 3.

– 10 – IEC 62056-3-1:2021 RLV © IEC 2021
PDU Protocol Data Unit
PRE COM field value: Pre-selection of energised stations
REC COM field value: Remote programming exchange request
RSO COM field value: Response to a call to forgotten stations
SEL COM field value: Acknowledgement of the pre-selection of energized stations
STSAP Source Transport Service Access Point
TAB In the case of the EURIDIS profiles without DLMS and without DLMS/COSEM: data code.
In the case of profiles using DLMS or DLMS/COSEM: value at which the equipment is
programmed for Discovery
TABi List of TAB field
TASB Duration of an Alarm Signal on the Bus
TIC Transmission of Information to the Customer
TOAG Maximum wait time for an energized station once selected, to recognise a general call AGN
TOALR Wait before sending an AGN after reception of an AGN or AGT
TOL Maximum waiting time for a request from the upper layer
TOPRE Maximum waiting time for a response to a pre-selection.
TOU Time of Use
TPDU Transport Protocol Data Unit
TSDU Transport Protocol Service Unit
TRA COM field value: Acknowledgement of point to point transfer
TRB COM field value: Broadcast remote transfer frame not acknowledged
TRF COM field value: Point to point remote transfer exchange
T1 Time out to wait for a response according to a request
XBA COM field value: Response to a change of speed request
XBR COM field value: Change of speed request
ZA1 Field reserved for bidirectional programming authentication
ZA2 Field reserved for bidirectional programming authentication

4 General description
4.1 Basic vocabulary
All communication calls upon two systems called Primary Station and Secondary Station. The
Primary Station is the system that decides to initialize a communication with a remote system
called Secondary Station; these designations remain valid throughout the duration of the
communication.
A communication is broken down into a certain number of transactions. Each transaction
consists of a transmission from the Transmitter to the Receiver. During the sequence of
transactions, the Primary Station and Secondary Station systems take turns to act as
Transmitter and Receiver.
For the local bus data exchange profile with DLMS or DLMS/COSEM, the terms Client and
Server have the same meaning as for the DLMS model (refer to IEC 61334-4-41 or
IEC 62056-5-3). The Server (which is a Secondary Station) receives and processes all
submissions of specific service requests. The Client (which is a Primary Station) is the system
that uses the Server for a specific purpose by means of one or more service requests.

4.2 Profiles, layers and protocols
4.2.1 Overview
This document specifies three profiles as shown in Figure 1.
• the base profile (without DLMS), see 4.2.2;
• the profile with DLMS, see 4.2.3;
• the profile with DLMS/COSEM; see 4.2.4.
The physical layer in the three profiles is the same except that in the DLMS/COSEM profile
speed negotiation is available. This common physical layer allows stations using different
profiles to be installed on the same bus.

Figure 1 – IEC 62056-3-1 communication profiles
4.2.2 Base profile (without DLMS)
The base profile (without DLMS) uses three protocol layers:
• the physical layer with the Physical-62056-3-1 protocol specified in 5.1;
• the data link layer with the Link-62056-3-1 protocol, specified in 5.2, and
• the application layer with the Application-62056-3-1 protocol specified in 5.3.

– 12 – IEC 62056-3-1:2021 RLV © IEC 2021
This profile allows remote reading, remote programming, point-to-point remote transfer – which
is a simplified remote programming service – broadcast remote transfer, remote supply of
secondary stations, detecting forgotten stations and alarm functions. The related
communication services are specified in 4.4.
4.2.3 Profile with DLMS
The profile with DLMS uses three protocol layers:
• the same physical layer as the base profile, specified in 5.1;
• the data link layer using the Link-E/D protocol, specified in 6.2; and
• the application layer specified in IEC 62056-51, using the Transport+, Application+ and
DLMS+ protocols, see 6.3.
This profile also allows using DLMS as specified in IEC 61334-4-41. The related communication
services are specified in 4.5.
4.2.4 Profile with DLMS/COSEM
The profile with DLMS/COSEM uses four protocol layers:
• the physical layer, similar to the one used in the base profile and the profile with DLMS,
specified in 5.1, but with speed negotiation, see 7.2;
• the data link layer using the Link-E/D protocol. This is the same as the data link layer of the
profile with DLMS, except that it interfaces with the support manager layer and the transport
layer. See 7.3;
• the support manager layer supports some specific process for the management of the bus,
see 7.4;
• the transport layer provides segmentation and reassembly of APDUs, see 7.5;
• the application layer as specified in IEC 62056-5-3 taking into account some restrictions of
the Euridis bus, see 7.6.
The profile with DLMS/COSEM allows using the COSEM object model and the DLMS services
accessing the COSEM objects over the Euridis bus.
4.3 Specification language
In this document, the protocol of each layer is described by state transitions represented in the
form of tables. The syntax used in making up these tables is defined by a specification language
described in Annex A.
In the event of a difference in interpretation between part of the text and a state transition table,
the table is always taken as the reference.
4.4 Communication services for local bus data exchange without DLMS
4.4.1 Overview
The list of available services (see Annex I) at the Application level layer is:
a) remote reading of data, see 4.4.2;
b) remote programming of data, see 4.4.3;
c) point to point remote transfer, which is a simplified remote programming service, see 4.4.4;
d) broadcast remote transfer, 4.4.5;
e) bus initialization, 4.4.6;
f) forgotten station call, 4.4.7.

4.4.2 Remote reading exchange
The ENQ exchange consists of two frames arranged in one sequence:
• remote reading frame containing the type of data to select in the TAB field
1 6 1 1 1 2
byte bytes byte byte byte bytes
-------------------> N ADS ADP COM TAB CRC
|
COM=ENQ (ENQuery) see D.1
• positive acknowledgement frame with the selected data in the DATA field
1 6 1 1 1 0 to 116 2
byte bytes byte byte byte bytes bytes
<------------------- N ADS ADP COM TAB DATA CRC
|
COM=DAT (DATA) see D.1
• negative acknowledgement frame (TAB identifier unknown)
1 6 1 1 2
byte bytes byte byte bytes
<------------------- N ADS ADP COM CRC
|
COM=DRJ (Data ReJected) see D.1

4.4.3 Remote programming exchange
The REC exchange consists of four frames arranged in two sequences. Since there is an
internal sequence for authentication purpose, from the application point of view, it seems to be
only one sequence with two frames:
• remote programming frame containing data in the DATA field and their type in the TAB field
1 6 1 1 8 8 1 0 to 100 2
byte bytes byte byte bytes bytes byte bytes bytes
-------------------> N ADS ADP COM ZA1 ZA2 TAB DATA CRC
| NA1 0
COM=REC (RECeption) see D.1
– 14 – IEC 62056-3-1:2021 RLV © IEC 2021
• positive acknowledgement frame (no authentication trouble)
1 6 1 1 8 8 2
byte bytes byte byte bytes bytes bytes
<------------------- N ADS ADP COM ZA1 ZA2 CRC
| 0 0
COM=EOS (End Of Session) see D.1

• negative acknowledgement frame (no authentication trouble but remote programming data
not validated)
1 6 1 1 2
byte bytes byte byte bytes
<------------------- N ADS ADP COM CRC
|
COM=DRJ (Data ReJected) see D.1

Authentication is carried out by an exchange of random numbers ciphered using a secret key
specific to each Secondary Station. The random numbers are defined in 8 bytes and they are
ciphered with the DES algorithm using an 8-byte ciphering key Ki known both to the Primary
and the Secondary station.
A random number NA1 is first generated by the Primary Station and transmitted into the ZA1
field of the remote programming frame while field ZA2 is set to zero.
On arrival at the Secondary Station, field ZA1 is ciphered by the DES algorithm with key Ki to
get the ciphered random number NA1K. Then occurs the internal sequence for authentication
which consists of two frames.
The first frame (from Secondary to Primary Station) contains this random number NA1K in field
ZA1 and a random number NA2 generated by the Secondary station in field ZA2.
On reception of this frame, the Primary Station compares the ZA1 field to an NA1´ number
obtained by ciphering the transmitted NA1 number using the DES algorithm with key Ki. If NA1´
= ZA1, then the Primary Station considers the called Secondary Station as authenticated.
Otherwise, it considers the Secondary Station has not been authenticated and aborts the
communication session.
After correct authentication of the Secondary Station, the Primary Station first ciphers the
random number NA2 by the DES algorithm with key Ki to get the ciphered random number NA2K
and then transmits it into field ZA2 while field ZA1 is set to zero.
On reception of this response frame, the Secondary Station compares the ZA2 field to an NA2´
number obtained by ciphering the transmitted NA2 number using the DES algorithm with key
Ki. If NA2´ = ZA2, then the Secondary Station considers the Primary Station as authenticated.
Otherwise, it considers the Primary Station has not been authenticated and sends a negative
acknowledgment frame.
The internal authentication exchange is the following:
• internal authentication frame containing the ciphered random number NA1K in field ZA1 and
the random number NA2 in field ZA2
1 6 1 1 8 8 1 0 to 100 2
byte bytes byte byte bytes bytes byte bytes bytes
<------------------- N ADS ADP COM ZA1 ZA2 TAB DATA CRC
|  NA1K NA2
COM=ECH (ECHo) see D.1
• positive response frame containing the ciphered random number NA2K in field ZA2 (if the
Secondary Station is considered as authenticated)
1 6 1 1 8 8 2
byte bytes byte byte bytes bytes bytes
-------------------> N ADS ADP COM ZA1 ZA2 CRC
I 0 NA2K
COM=AUT (AUThentication) see D.1

• an authentication rejection frame replaces th
...