Reading data from Landis+Gyr E350 (Work in progress)

The idea is to read some data from the optical interface from a Landis+Gyr E350 [technincal sheet] electricity meter. The meter seems to use the IEC 62056-standard. The optical interface uses the IEC 62056-21:2002 Direct local data exchange (earlier: IEC 61107) for the optical probe. If the meter would use DLMS/COSEM-standard I could use Gurux.

The meter has its own optical probe: AIP200 but I can build my own for 0.50€. I found a similar project from the Arduino forum. In the project they used a photo reflective sensor which is basically just an infrared led and a phototransistor. Bebek (finnish electronic store) had a cheap photo reflective sensor that i used. It contain Vishay's TCRT5000. To read the optical sensor I needed to connect it to a pull-up resistor.

Here is the wiring diagram.

This is how i tested that the optical sensor sees the infrared led. The board led (13) stops blinking when it sees IR light.

int led = 13;
int irled = 5;
int phototransistor = A5;
int del = 50;

void setup() {
    pinMode(irled, OUTPUT);
    pinMode(led, OUTPUT);
    Serial.begin(115200);
    while (!Serial) {
      ;  
    }
    digitalWrite(irled, HIGH);
}

void loop() {
  del = 50;
  digitalWrite(led, HIGH);
    int out = analogRead(phototransistor);
    if(out < 1000){
      Serial.println(out);
      del = 0;
    }
  delay(50);
  digitalWrite(led, LOW);  
  delay(del); 
}

So I was able to build an optical probe but now i have to know what to send to the electric meter and how to read the output. I just tried to read IR signals from the meter but it did not broadcast anything. Of course I did try to just send IR light to it and I got some reaction: it triggered the tamper alert (an alarm clock on the lcd screen). This should only happen in case of detection of terminal cover opening, detection of DC magnetic field, sealable access lock to voltage connections or detection of Disconnector tampering (Disconnector meters only). The alarm on the screen lasted for about 10 seconds and then went back to normal.

The protocol
I tried to find some documentation about the IEC 62056-21 but the standard document costs 280 CHF. It would contain description of protocal modes and how to read the optical interface.

IEC 62056-21:2002 Direct local data exchange [Source] A meter sends ASCII (in modes A..D) or HDLC (mode E) data using a serial port. The physical media is usually modulated light, sent with an LED and received with a photodiode. The protocol is usually half-duplex.

• Sign on sequence:

  • During sign-on, the optical probe unit addresses a particular meter by number
  • Various parameters such as the maximum frame length during transmission and reception, whether multiple frames can be sent without acknowledging individual frames (Windowing), the fastest communication rate that they can both manage (only in case of mode E switching to HDLC) etc
  • Next the meter informs the optical probe unit about the various parameters that are available with it in various security settings
  • If the parameter required is in no security group, just a get.request will provide the desired response
  • If the parameter required is in low security group, a password authentication is required before information can be read
  • If the parameter required is in high security group, the meter sends a cryptographic password. The reading unit must return an encrypted password. If the password exchange is ok the reading unit is "signed on."

• Data exchange:

  • Meter description describes some registers that describe the current count of metered units (i.e. kilowatt hours, megajoules, litres of gas or water) and the metering unit's reliability (is it still operating ok?)
  • Most metering units have special modes for calibration and resetting meter registers
  • These modes are usually protected by anti-tampering features such as switches that sense if the meter enclosure has been opened

• Sign off:

  • If no sign-off message is sent, the meter automatically signs off after a previously negotiated time interval after the last message.

IEC 62056-21: Telegram structure [here seems to be most of what i need: Source]
The Baud rate identification is used for the baud rate changeover. The "request message", the "identification" and the "acknowledgement/option" are transmitted with an initial rate of 300 Bd ( not valid for protocol mode D ). The baud rate identification in the message is determined by the used protocol mode.

• Protocol mode A:
  No baud rate changeover is provided for this mode. Each character is allowed, excepted are the characters "/", "!" and the character may not be specified as baud rate for protocol mode B or C.

• Protocol mode B with baud rate changeover:
  In this mode the "acknowledgement/option" is not used.
  A - 600 Bd
  B - 1200 Bd
  C - 2400 Bd
  D - 4800 Bd
  E - 9600 Bd
  F - 19200 Bd
  G, H and I are reserved.

• Protocol mode C and E with baud rate changeover:
  The "acknowledgement/option" is only used in these modes.
  0 - 300 Bd
  1 - 600 Bd
  2 - 1200 Bd
  3 - 2400 Bd
  4 - 4800 Bd
  5 - 9600 Bd
  6 - 19200 Bd
  7, 8 and 9 are reserved.

• Protocol mode D:
  No baud rate changeover is provided for this mode. Data transmission is determined on 2400 Bd. The baud rate identification is always 3.

Now the next thing to figure out is what query data I should send to the device. Here is some brainstroming:

// I have to use an Arduino Mega to use two different serial ports (one for usb to computer and one for the optical probe)
#include < SPI.h>

int irled = 5;
int phototransistor = A5;
bool query = 0;

void setup() {
    pinMode(irled, OUTPUT);
    Serial.begin(115200);
    Serial1.begin(300); // Starting with 300 Bd
    while (!Serial) {
      ;  
    }
    Serial.print("Arduino reading Landis+Gyr E350:\r\n\n" );
}

void loop() {
  if(query){
      byte cmd[] = {0x2F,0x3F,0x21,0x0D,0x0A}; // query "/?!"+< 13>< 10>
      Serial1.write(cmd,5); 
  }

  if(query){
      byte cmd[] = {0x06,0x30,0x30,0x30,0x0D,0x0A}; // < 06>"000"< 13>< 10> for energy data
      Serial1.write(cmd,6); 
  }

  if(Serial.available()){
      int inByte = Serial.read();
      Serial1.print(inByte, BYTE); 
  }

  if(Serial1.available()){
       a = Serial1.read() & 0x7F; // cheap way of converting from 8N1 to 7E1
       char b = a; // convert serial byte to ASCII character
       Serial.print(b);
  }   
}

Some cool stuff, but not exactly for this project:

• How to read E350 with a RJ11-cable project.
• GPRS connection to Landis+Gyr meter.
• Termineter security testing of smart meters (Protocol C1219-2007 with 7-bit character sets).