Anglian Water smart meters

[Kevin Fairhurst]

Hello!

Have recently had a smart meter fitted by Anglian Water, and unlike this guy - https://www.northantstelegraph.co.uk/news/people/corby-anglian-water-customer-refusing-to-pay-bill-after-big-brother-smart-meter-installed-without-his-consent-3975005 - my response was to get myself an SDR from Amazon and see if I could snoop on the signals and monitor what was going on.

First things first, they installed a Sensus 640 volumetric meter, which supposedly broadcasts short range on either 433MHz or 868MHz. This feeds in to a Sensus SmartPoint 550M which I think is using the 412MHz band.

I'm using an Unraid server running Docker, so started off just using a pre-built container called "metermon" which unfortunately did not find anything.

After doing some digging around, I ended up with a container called rtl_433tomqtt which allows you to pass in your own options into rtl_433 & anything it finds it passes on to MQTT so my HomeAssistant setup can pick it up.

Unfortunately the only thing it found on my initial tests were my weather stations which already feed through via a page scraper (although tbh I will possibly change that once I get the water meter sorted!)

After reading up on the -S unknown option, I realised the docker instance I was using was not allowing files to save out to the root folder (based on the ENTRYPOINT) so I ended up rebuilding it to allow a home directory which could be mapped in.

Is there a way to shortcut scanning the frequency bands, or do I need to go through everything from 868.00 to 868.99 one by one?

Even doing steps every 100KHz ends up with something like this which will take the best part of two weeks to run! And then another 2 weeks for the 412MHz band, then another 2 weeks for 433MHz...

rtl_433 -S unknown -s 1M -g 25 -f868.0M -f868.1M -f868.2M -f868.3M -f868.4M -f868.5M -f868.6M -f868.7M f868.8M -f868.9M -f869.0M -H 86400

(running for 24h based on assumption that the box is transmitting every 6 hours to the masts, and it's possible I might miss a couple due to passing traffic / weather / timing bad luck, and I want a couple of readings to allow me to see the differences between them to validate against physical readings)

Cheers,

Kev

[Christian Z.]

If you set a sample rate of 1024k (later you might need 1000k or 1200k to best match m-bus bit rates) instead of the default 250k the saved files will be 4x bigger but you also cover a band of 1MHz. Just the 433.92M and 868M will be enough to grab all transmissions theres.

Actually use e.g. 868.4M as there are seldom transmissions below 868M but there are some up to ~868.7M.

[Kevin Fairhurst]

Thanks... giving that a go now!

I misunderstood the sample rate and thought it was to do with the granularity of the checking (bits per second) as opposed to the bandwidth being scanned at once for a recognisable signal.

[Christian Z.]

It's both ;) The time resolution sets the maximum frequency resolution according to the Nyquist–Shannon sampling theorem.

The bandwidth would be half the sample rate for a real signal, but SDR I/Q data is complex and thus we get bandwidth == sample rate.