Reverse your smart energy meter with this simple trick! - Page 1
Forum section: electronics / general

author: Jeroen3
author_rank: Super Contributor
timestamp: August 13, 2021, 07:26:45 am
content: So, apparently several Smart Energy Meters in the Netherlands read incorrect in certain conditions.It was already established afew years agothat some LED lamps could cause some meters to read high.However, today I found this, fool the smart meter in your advantage!Research paper: How to Earn Money with an EMI Problem: Static Energy Meters Running Backwards.News item (dutch):Gelderlander.Apparently, Chris bought a dimming wireless socket from KlikAanKlikUit (a brand in the netherlands) and used it for his TV.tldr: This caused significant current pulses at specific phase angles fooling the meter in thinking he was backfeeding power.Some others meters increased the power reading.Interesting find. Soon the dodgy technology "power savings plug" will contain power corruptors...

author: Halcyon
author_rank: Unknown
timestamp: August 13, 2021, 10:08:01 am
content: Until they flash a firmware update over-the-air, rendering the "hack" useless.

author: Zero999
author_rank: Super Contributor
timestamp: August 13, 2021, 10:28:28 am
content: It's also quite likely against the law.

author: Berni
author_rank: Super Contributor
timestamp: August 13, 2021, 10:36:03 am
content: Is it still illegal if the meters are so crappy that a normal load with terrible power factor can cause it to read this wrong?This is sort of like your ISP used a crappy bandwith limiter solution that would let you get 2x the amount of internet bandwidth if you sent packets with just the right packet size. Then they sue you for using more internet than they allowed you to use.If they power company wants the accurate electricity usage reading, how about they pony up and buy some meters that actually work.

author: Alti
author_rank: Frequent Contributor
timestamp: August 13, 2021, 10:48:37 am
content: Quote from: Jeroen3 on August 13, 2021, 07:26:45 amI'd say that every measurement instrument imaginable can only be expected to return results within conditions it has been designed and tested for. This not only applies to power meters.In case of power meters the error bound (both plus and minus) is characterised but again, only in certain test conditions. Of course one cannot create test condition that includes "all possible current draw patterns" because a production test would have taken quite a long time then. Instead, a product is tested against standardised shape but you cannot infer from that the measurement error never exceeds boundaries - this has not been tested.I suspect these meters are only designed to deal with EMC-compliant loads. Had someone used not-so-compliant load, the returned results could have included errors out of specified bounds.Now the question is: is this a problem of a meter design and should any meter be robust against eBay jammers? Because then someone would have to prove non-existance of a pattern for which the error exceeds specified bounds.

author: Zero999
author_rank: Super Contributor
timestamp: August 13, 2021, 11:36:59 am
content: Quote from: Berni on August 13, 2021, 10:36:03 amIf you're intentionally hacking it then yes, it is illegal.

author: CJay
author_rank: Super Contributor
timestamp: August 13, 2021, 11:40:31 am
content: Quote from: Zero999 on August 13, 2021, 11:36:59 amIntent is everything yes.I wonder if this would have the effect of lowering the metered power consumption so be unnoticeable in a normal household?

author: Red Squirrel
author_rank: Super Contributor
timestamp: August 13, 2021, 11:49:25 am
content: Wow that's pretty bad. I could see that easily happen accidentally and lot of people getting screwed over by that once they are "caught".

author: Jeroen3
author_rank: Super Contributor
timestamp: August 13, 2021, 12:39:04 pm
content: Well yes of course tampering with metering equipment is against the law. Especially intentionally!But the thing is, these type of loads are not at all that uncommon today.The standard doesn't explicitly tell you to test these waveforms. Only how much you may be wrong with what harmonics and such.It does suggest some test setups, like half wave rectification and phase angle dimming, not the kind of pulses seen here,yet.

author: Zero999
author_rank: Super Contributor
timestamp: August 13, 2021, 02:48:08 pm
content: Quote from: Red Squirrel on August 13, 2021, 11:49:25 amAs mentioned above, intent is everything. If it's caused by a fault in the meter and a load, which just happens to emit the right kind of noise for it to roll backwards, then you'll probably get away with it. On the other hand, if it can be proven you designed a device, specifically to emit noise, with the intention of causing the meter to roll backwards, then you can be done for fraud.I also wouldn't be surprised if the power company could theoretically, get you to pay them, for any electricty they gave you for free, even if it was their error, but they would have a hard time proving it and it would have to be split up into reasonable, instalments, over a fair time period.

author: langwadt
author_rank: Super Contributor
timestamp: August 13, 2021, 03:35:38 pm
content: Quote from: Zero999 on August 13, 2021, 02:48:08 pmI'd expect that if the bill is high the power company will say the meter is has been tested so pay up, if it bill is low theywill assume you cheat and tell you to pay up an estimate based on previous bills

author: Kleinstein
author_rank: Super Contributor
timestamp: August 13, 2021, 03:53:14 pm
content: The old article about meters reading high with LED lamps was a case of a load outside the permitted limits. It this can the meter is allowed to read a little higher than normal. For normal loads this does not make a difference, as normal loads are usually much more well behaved. Even if it reads some 10% high an a poor designed Chinese LED lamp this would not make a big different (maybe $1). It would still read OK with the significant consumers like water heating, cooking, washing mashine or air conditioning.A poor load could also cause an error to the other side - but still, what is the savings if it reads the poor power factor LED low and still gets it right with the main part. It is illigal to manipulate / fool the meter and it is also illegal to cause such EMI. It can effect neighbors and they may complain about poor grid quality and find the culprit. Modern smart meters may detect and report excessive EMI, very poor power factor or similar.

author: TheSteve
author_rank: Unknown
timestamp: August 13, 2021, 05:27:41 pm
content: I lost one leg of the power coming into my house, the smart meter didn't notice or generate any fault. I'm not convinced they are very smart.

author: coppice
author_rank: Super Contributor
timestamp: August 13, 2021, 05:55:00 pm
content: The article is pretty vague. It would be interesting to see a proper description of the type of dimmer causing this, and the waveforms it produces.

author: coppice
author_rank: Super Contributor
timestamp: August 13, 2021, 06:03:01 pm
content: Quote from: Alti on August 13, 2021, 10:48:37 amThese meters are generally only tested in accordance with WELMEC, OIML, IEC62052-xx and related specs (except in the US, which has its own ANSI specifications). If the IEC specs don't call for a test, and the utility doesn't lay down the test as an additional requirement, it won't be done. Good meter developers do a lot of additional internal testing for a variety of potential problems, but there is no commonality in those tests, and no requirement to publish results.

author: amyk
author_rank: Super Contributor
timestamp: August 14, 2021, 02:02:29 am
content: Does anyone else get reminded of the old ads in the back of some electronics magazines that told you how to make a device that would cause the meter to run backwards? I always thought those were just scams for the gullible... this was decades ago.

author: station240
author_rank: Unknown
timestamp: August 14, 2021, 03:16:42 pm
content: Quote from: coppice on August 13, 2021, 05:55:00 pmHuh ?Read the linked PDF, page 4 onwards, figure 6 in particular.

author: coppice
author_rank: Super Contributor
timestamp: August 14, 2021, 03:58:43 pm
content: Quote from: station240 on August 14, 2021, 03:16:42 pmAh, I missed that there was a detailed document as well as the news article.The measurements seem interesting, but the conclusion is bogus. They assume this must be an EMI issue, without investigation. If you look at the design of various measuring techniques used in meters, there could well be problems with the power measurement algorithm being fooled by the waveforms. I wonder if the 4 meters giving funky results all use the same measurement front end, and what that front end might be?

author: Jeroen3
author_rank: Super Contributor
timestamp: August 14, 2021, 08:22:48 pm
content: I think that maybe the big short current pulse is being flattened and delayed by the digital filtering.Can't make perfect filters...

author: Zero999
author_rank: Super Contributor
timestamp: August 14, 2021, 08:30:01 pm
content: Quote from: langwadt on August 13, 2021, 03:35:38 pmThat's why we have courts.If I were running a power company and I genuinely thought a customer had cheated, then I wouldn't be just looking at reclaiming the money, but they also received a suitable penalty from the authorities to deter them and others.

author: Cyberdragon
author_rank: Super Contributor
timestamp: August 14, 2021, 11:02:17 pm
content: Quote from: TheSteve on August 13, 2021, 05:27:41 pmFun fact, cheap digital meters extract power from only one leg, no redundancies. If you loose that leg, the meter goes out, the remaining leg is free power.

author: Alti
author_rank: Frequent Contributor
timestamp: August 15, 2021, 11:31:24 am
content: The solution could have been to split counting of energy into several harmonics ranges (digitally).Then first counter integrates sub-harmonics, second integrates around main 50Hz, third all other higher harmonics. Then the metering could have been tested for tight <1% errors only around main frequency. Designing a 1% power meter frontend for MHz eBay jammers would have been expensive and unnecessary so maybe let the third meter integrate higher harmonics with +-30% error and just apply higher charge on this counter. This could have been relatively easy to design and to test.

author: Berni
author_rank: Super Contributor
timestamp: August 16, 2021, 07:19:49 am
content: No need for any fancy FFT or anythyng.You just need to sample the current and voltage about 1000 times per the 50Hz cycle, multiply them together to get instantaneous power then average out the power across the cycle. With some more analysis you can also extract the reactive power and power factor from this.It's just a matter of sampling fast enough to catch all the relevant harmonics while having proper low pass filtering on the voltage and current sense inputs to keep out any high frequency or RF noise. This keeps the noise from perhaps demodulating itself in the current shunt amplifier or alias in the ADC.Test the thing with a large frequency sweep from Hz to high MHz and if the ADC readings don't twitch or move at all then it will be resilient to pretty much anything you could reasonably throw at it (So this does not include pointing a microwave oven magnetron at it)

author: SeanB
author_rank: Super Contributor
timestamp: August 16, 2021, 08:09:45 am
content: Quote from: amyk on August 14, 2021, 02:02:29 amNo, those were easy, you just use a iron core welding transformer, or three, which was essentially a near perfect inductive load. The high out of phase current would saturate the current sense coil, and then cause the meter to either not read correctly, or to run backwards as the core came out of saturation and generated a magnetic field that appeared to be a return current flow. The solution from the power companies was to simply include a small non reverse cam and pawl on the meter movement shaft, so it would not run backwards more than a single revolution in this case. For those who were using the arc welders to weld, the meter simply did not move while they were connected but not welding, though when you welded the meter would run forward as usual, as the resistive load overwhelmed the inductive current flow.Modern meters will simply measure the inductive current flow as reactive power, and will ignore it. Also why you need a second meter in series for solar feed in, the flow of reactive power is not counted, only resistive current flow.

author: Alti
author_rank: Frequent Contributor
timestamp: August 16, 2021, 01:19:35 pm
content: Quote from: Berni on August 16, 2021, 07:19:49 amIf the sample is made at that frequency then conditioning circuit starts from anti-aliasing filter (it has to attenuate all frequencies above F/2) otherwise you get junk. At higher frequencies you can happily draw power in between ADC samples. And that is what this dumb eBay jammer does I suspect. I think it (unintentionally) locks fast rising edge with ADC, offset with zero crossing.With this brute force approach and keeping within 1% accuracy you would have to increase sampling to more than 2*some frequencies limited by RLC bandwidth of a piece of cable that separates power meter and jammer. Otherwise a purposely built jammer can be/will be created that locks into ADC sampling and extracts 1.01kWh when ADC counts 1.00kWh (thus defying your concept). That is essentially a proposition of a 1% accurate measurement instrument with DC to tens of MHz bandwidth.

author: Berni
author_rank: Super Contributor
timestamp: August 16, 2021, 03:35:29 pm
content: Quote from: Alti on August 16, 2021, 01:19:35 pmOnce you have a proper low pass filter in front of the ADC you can't have pulses just "slip trough". No matter at what point between the samples the huge narrow pulse happens the low pass filter will flatten it out enough to be seen over a few consecutive samples of the ADC. As far as the ADC is concerned drawing 1000A for 1/1000th of a ADC sample time is the same as drawing 1A for the whole sample time, the same amount of charge has also flown trough the meter.There is no need to have a ridiculously fast ADC. It just needs to be fast enough to reasonably accurately capture a weird wavy waveform. That way the correct parts of the waveform get calculated to the correct parts of the voltage sine wave. Once you get to a fine resolution it doesn't matter anymore, the voltage sine wave does not change that much in 1/1000th of a cycle time. At that point the buckets of charge get assigned to pretty much the right voltage. Also even if you ware to time it to the ADCs sample rate, how would you get the sample rate and lock on to it? You are not allowed to open up the meter and hook into it. The actual sample rate it likely also drifting around since you wouldn't have some incredibly precise OCXO oscillator in there.What actually likely happens is that RF noise is not filtered away properly and gets demodulated somewhere in an amplifier or ADC. Here is one example of such a thing happening to a big name brand multimeter:https://www.eevblog.com/2016/10/12/eevblog-933-keysight-u1272a-emc-issue/

author: Zero999
author_rank: Super Contributor
timestamp: August 16, 2021, 03:53:22 pm
content: You don't actually need to know the waveform to measure the RMS voltage, current and power. You could sample at 1Hz, for a long period of time and still get an accurate reading, so long as the sample clock isn't in phase with the mains, so it gets samples from the whole waveform, after a long enough period.

author: Alti
author_rank: Frequent Contributor
timestamp: August 16, 2021, 05:19:59 pm
content: Quote from: Berni on August 16, 2021, 03:35:29 pmAny high frequency disturbance signal with frequency content starting above cutoff frequency is not going to get through low pass antialiasing filter and some of the information is lost. Remember that power meter neither integrates current nor voltage but the product of both. So if you superimpose high frequency disturbances: on current path that is in phase with disturbance on voltage path, none of the ADC channels is going to register that so some energy is going to get through unregistered.So if ADC sampled voltage: U and current I then the meter is going to register at this point:P=U*II these samples on mains cable were (U+1) and (U-1) with (I+1) and (I-1) respectively (for halves of the sampling period), then:P' = ((U+1)*(I+1) + (U-1)*(I-1))/2 = U*I+1I think this shows that you cannot measure something that you filtered out.

author: Zero999
author_rank: Super Contributor
timestamp: August 16, 2021, 06:09:00 pm
content: I wonder if spread spectrum sampling would help? Random would be idea, but you'll still be confined to the quantum of the clock frequency. I suppose using a VCO, fed with a white noise generator, for the clock would produce a random enough sample rate. The problem then becomes interfacing the randomly sampling hardware, with other devices, running at a steady clock rate.

author: Jeroen3
author_rank: Super Contributor
timestamp: August 17, 2021, 06:35:52 am
content: From what I know, most energy meters lock the sampling rate to 64, 128 or 256 samples per cycle.A way to do this, though I'm not sure if this is the way it is actually done, is to oversample royally, then decimate to your required samples per cycle.This ensures all further calculations, like power and reactive power, are done with the same phase error free stream.However, that is only the sampling, the power units calculation is another subject. Different methods, different speeds and errors.https://www.mdpi.com/1996-1073/13/17/4322

author: coppice
author_rank: Super Contributor
timestamp: August 17, 2021, 11:32:40 am
content: Quote from: Jeroen3 on August 17, 2021, 06:35:52 amI don't know of any energy measurement front end for a consumer meter which locks the frequency of the ADC sampling to the mains. They all sample at a fixed rate, and calculate at the same rate. What you are describing sounds like the design of a power quality monitor. Most of those process synchronised samples, typically at 256 samples per mains cycle these days. However. most modern designs don't actually run their ADCs synchronously with the mains. They let them run at a fixed rate, and then digitally resample to a precise power of two multiple of the prevailing mains frequency. Then they can perform things like FFTs without worrying about windowing effects, which can really hurt accuracy when you are trying to measure to 0.1% or better. They work out the exact mains frequency by analysing the raw sampled stream, and continuously adapting as the frequency of the mains, or their own raw sample clock, might drift with time.

author: Alti
author_rank: Frequent Contributor
timestamp: August 17, 2021, 12:12:34 pm
content: Quote from: Zero999 on August 16, 2021, 06:09:00 pmI think that the knowledge about exact moment of when ADC is sampling, for the purpose of tampering the measurement results, has minimal practical value. It might be advantageous when the disturbance is at about similar frequency as sampling but when the disturbance is tens or hundreds of times faster then what difference that might be? The meter is not going to notice that upper part of BW anyway.