Reverse-engineering Kamstrup 382 electricity meter - Page 1
Forum section: electronics / projects

author: casper.bang
author_rank: Frequent Contributor
timestamp: August 06, 2013, 07:41:17 pm
content: So I have finally taken the time to describe my progress of reverse-engineering the protocol used by the Kamstrup 382 electricity meter, as well as polishing the associated source code and put on GitHub. I have the suspicion that this kind of meter is mostly used in Scandinavia, but I figure it may be of interest to others in here. In particular, I'd be interested in anyone recognizing the very odd encoding used.Blog post:http://blog.bangbits.com/2013/08/talking-to-kamstrup-685-382-electricity.htmlKMP source code:https://github.com/casperbang/KMP382-driver/blob/master/MeteringSolution/Metering/com/bangbits/metering/protocol/MeterProtocolKMP382.cs

author: amyk
author_rank: Super Contributor
timestamp: August 06, 2013, 08:02:41 pm
content: I can't think of any examples at the moment but ASCII-hex encoding is rather common... probably it's to provide extra reliability over the link.

author: casper.bang
author_rank: Frequent Contributor
timestamp: August 06, 2013, 08:29:02 pm
content: Quote from: amyk on August 06, 2013, 08:02:41 pmInteresting theory... but by only allowing 16 values to be legal out of 256, you have to make the data-stream that much longer to convey the same information, thereby subjecting the link to a greater chance of getting an error. Oh well.

author: Niklas
author_rank: Frequent Contributor
timestamp: August 06, 2013, 09:52:51 pm
content: With ASCII encoding you will send more bytes compared to "pure" binary. On the other hand, how do you verify that the binary message was sent without errors? Checksum or inverse copy of data perhaps, but that also adds length. And if the communication get out of sync, how do get it back into sync again? Tricky timeouts and defined "bus idle" periods to find the start of a message again.I am not so sure if the longer message length will make it more prone to getting errors. Think of these two cases with different definitions of TRUE and FALSE:1: FALSE = 0, TRUE = 1..2552: FALSE = 0xAA, TRUE = 0x55, other values undefined/errorIn case 1, a single flipped bit can cause a lot of problems and it might be impossible to detect it. A flipped bit in case 2 will result in an undefined value and taken care of by the error handling.Some of the benefits of using ASCII- Readable by a human using easily available software such as HyperTerminal- Defined valid range of data- Can use special characters as start and stop signaling, makes resync easy- Probably easier for "PC programmers", aka API cooks, to code using standard atoi function.

author: casper.bang
author_rank: Frequent Contributor
timestamp: August 07, 2013, 01:09:15 pm
content: Quote from: Niklas on August 06, 2013, 09:52:51 pmI see what you are saying Niklas, to "hide" in the entropy. It's not the first time I see odd things with legacy meters though, the M-bus protocol tends to duplicate byte fields in the header for redundancy reasons.Surely it's much more demanding for the meter to go through these mappings rather than using raw bytes. Also, the protocol includes a 1 byte LRC at the end and then of course there's the parity of the data-link layer underneath. I do believe that later models of this meter uses a proper 16bit CRC though.

author: madires
author_rank: Super Contributor
timestamp: August 07, 2013, 01:35:50 pm
content: Quote from: amyk on August 06, 2013, 08:02:41 pmI reversed engineer the control protocols of a few radio receivers/scanners and most use that encoding too. For cloning the master radio usually sends something like <address><hex encoded data><checksum> and the slave checks and ACKs each line. The last line contains a global checksum to verify the whole data sent (detecting missing lines for example).

author: bingo600
author_rank: Super Contributor
timestamp: August 07, 2013, 07:11:07 pm
content: Casper did you see this one ?http://kildal.dk/?page_id=117Ohh and could you post the schematic of the diy reader , incl the resistors to reduce the ir led levels ??/Bingo

author: Tepe
author_rank: Frequent Contributor
timestamp: August 07, 2013, 09:20:21 pm
content: I also have a Kamstrup (labeled 684-38B-*) but it is unfortunately mounted in an outdoors box which makes access to it somewhat less trivial.

author: casper.bang
author_rank: Frequent Contributor
timestamp: August 08, 2013, 06:38:42 am
content: Quote from: bingo600 on August 07, 2013, 07:11:07 pmBingo; I think I may have seen some early work from that guy, however the protocol used by him (and PHK if you're familiar with his blog posts on ing.dk) is a different (newer) one that won't work on any of the two 382 meters I've got a hold of. So unfortunately nobody to lean on.The optical reading head I made is based on schematics from an old Elector magazine, you may find archived here:http://pl.scribd.com/doc/50612482/Iec-1107-Electricity-Meter-InterfaceI pretty much uses component values as specified in the diagram, except boosted the transmission IR a bit (330 rather than 380 ohm) and also I made P1 a little easier to set by serial connecting a 57K resistor with a 100K trimmer. I reduced the stability caps C1 and C2 from 10uF to 4.7uF (I think you can go even lower) and that's about it. I have another simpler (non db9 pin compatible) version done, using just a cheap FTDI adaptor cable, but I am missing a scope to complete this. (I can't make up my mind about which entry level scope to get me).QuoteYeah my primary meter from the utility company SEAS/NVE is using Echelon which is also beyond me (both legally and technically). However, you can purchase a used Kamstrup 382 meter for around 350Kr, although a quick search only found one deal at 469kr:http://www.greenline.dk/Tavlemateriel-9/Elmaalere-231/Elmaaler---Brugt-Kamstrup-bimaaler-9510If you get a hold of such one, you can simply install it as a secondary meter - that's what I have done.

author: Tepe
author_rank: Frequent Contributor
timestamp: August 08, 2013, 04:25:23 pm
content: Quote from: casper.bang on August 08, 2013, 06:38:42 amDo what Dave did and get a $19.95 Hameg.I have a Hameg 203-7 which I am still hanging on to even though it was supplemented by a Rigol 1052E (upgraded to 100 MHz) a few years ago.

author: casper.bang
author_rank: Frequent Contributor
timestamp: August 08, 2013, 04:40:09 pm
content: QuoteI know what Dave says about it and trust me, I've listened to what he said about PSU's and multimeters and bought quality Agilent stuff accordingly.However, a 20Kg scope is just not an option for a variety of reasons. For one thing, I wouldn't know where to put a 20Kg CRT behemoth, I often use our living room as a field lab (makes wife happy) so portable is a huge plus and finally I do mostly digital stuff so I favor single-shot triggering with decent memory for drill-down inspection.PS: My my, tiny Denmark is decently represented on these forums.

author: Tepe
author_rank: Frequent Contributor
timestamp: August 08, 2013, 08:25:18 pm
content: Quote from: casper.bang on August 08, 2013, 04:40:09 pmThe Hameg weighs 7.5 kg and its depth is about 38 cm.The 1000 series Rigols (and similar DSOs) on the other hand are quite svelte and easy to store.