Click here for the Ban PLT website.

Sunday 5 November 2017

433.92MHz Energy monitor transmission monitoring and possible reverse engineering

On trying to find out exactly what my energy monitor device is transmitting, as I know it to operate on 433.92MHz I find this part of the band filled with transmissions, this is due to the vast array of licence free devices used here, particularly remote car keys as these are by far the most common of them all, this of course makes it harder for me to figure out what my energy monitor's transmitter is doing, though the only device making sense of the signals from the sender by the electricity meter is in fact the display for the energy monitor itself.

In order to do this I have connected an SDR to my laptop, my NESDR SMArt rather than my basic RTL-SDR as this would not have done a good job and currently I have no way of putting my antennas onto the basic one, and it is prone to drift and interference, whereas the NESDR SMArt is not as it's very well engineered, software side is SDR# as usual as it is my preferred choice, antenna is the shortest one that came with the NESDR SMArt as it seems to be the most effective, after some playing about the mode to receive all this appears to be AM, not FM as I initially thought.

The energy monitor is a cheap one I bought from the local Poundstretcher shortly after moving into the previous QTH, though it is based on an old design Efergy unit circa 2009 (possibly earlier) I see no information on what corresponding Efergy model number it is nor any means to reverse engineer the RF side to receive it and decode the data for putting into a graph or chart which the newer Efergy devices can do anyway with a simple add-on, though why buy it when you can build it yourself, I'm a tinkerer and radio Amateur, so why not play about with it, after all I do like taking stuff to bits, and no big loss if I break it as I can simply replace it with a newer Efergy unit.

Having not removed the covers from either side of the monitor, it appears to be a standard 433MHz TX/RX pair from photos I have seen online, the TX side has an unpopulated header on the main board (serial port maybe?) and so does the RX side (again, possibly a serial port), I've not got as far as finding any further information on what I should see on the SDR# waterfall nor have I figured how it transmits the data, aside from using, presumably, ASK which explains why I have to look at 433.92 in AM.

If I can figure this out it would be great, then I can hopefully extract the data and make it something that can be comprehended and put into a web-based graph or chart, all I need to do that is a 433 receiver, and a means to decode the data in the transmitted packets (Raspberry Pi would do a sterling job here and can run off a battery that can be recharged so it will read 0 in the event of a power outage), and then I'd be able to access my usage data from anywhere in the world

Let's see what comes of this then.

73 de 2E0EIJ

Update: 17:48

I have finally figured out how to get my energy monitor open and have done so, however all was not as expected

The CPU is in the centre as per the Efergy units however it appears that it is not the same device, the receiver is of a different type to the Efergy units as well, the unpopulated header is labelled differently and presents no real way to fit headers as a mounting screw fouls it, finding the embedded data in the radio signal from the transmitter will require some further work than I initially thought, if not I can simply buy a newer Efergy device and transfer this project to that as these are more common, though that would have to wait until payday methinks given I had to fork out for car parts and fitting last payday.

No comments:

Post a Comment

Due to past abuse and the ongoing issues that left me little choice to reduce time on twitter and IRC I have taken the decision to keep comments disabled indefinitely, apologies for this

Note: only a member of this blog may post a comment.