AOA Forums AOA Forums AOA Forums Folding For Team 45 AOA Files Home Front Page Become an AOA Subscriber! UserCP Calendar Memberlist FAQ Search Forum Home


Go Back   AOA Forums > Hardware > Hardware Hacking

Hardware Hacking The hammer and tongs school of Overclocking. (NOT for the beginner and you assume all risks)


Reply
 
LinkBack Thread Tools Rate Thread
  #1 (permalink)  
Old 6th September, 2012, 09:06 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Hacking CurrentCost Energy Monitor

I've spent a bit of time digging around the CurrentCost EnviR. It's basically a home energy monitor with a serial output that spits out XML. The sensor that I have is the OptiSmart, which basically monitors the flashing LED on my power meter. The LED flashes for every watt hour consumed, so it gives a pretty accurate indication of power consumption.

Anyhow, CurrentCost also make some development boards - basically just little boards you can connect up, and pair with the EnviR. I picked up a bundle of three digital ones (IE, on or off indicator), and set about working out what I can do with them.

When you short the sensor connector, it transmits a value of 500 watts. When you open the sensor connector, it transmits a value of 0. That's not really that useful. I quickly realised that I was going to need to modify the code running on them. The processor onboard is a PIC 16F689, and the board has an in circuit serial programming (ICSP) header to allow you to reprogram the board.

With a bit of eyeballing, I figured out the RF transmitter onboard was a HopeRF RFM02, which is really just a TXC101 chip (because the datasheet for the RFM02 is hopeless, but the datasheet for the TXC101 is actually ok). That's great, but being able to talk to the transmitter doesn't help if you don't know what to say to the wide world.

Anyhow, I break out my bus pirate to grab the configuration of the transmitter, by sniffing the SPI bus, so at least I know what frequencies and baud rate are being used.

I took the EnviR apart, and there's some connections inside for the receiver chip it uses (an RFM01 receiver module, using the RXC101 chip), and I was able to pull out the data that is received. Again, this is using the bus pirate, as the data comes out across the SPI bus.

I write some code, program up the PIC, and see what happens - the answer was nothing - it transmitted the data, but the receiver didn't accept it. Turns out I have to add a preamble to my packet in order for the receiver to recognise it! It's in the datasheet, but I hadn't really read that bit. So, I re-write the code, program up the PIC, and expect to see something on the screen.

But no. I've double checked my code and it all seems to be ok. I scratch my head, and tweak bits of code, clutching at straws... Eventually, I decide to pull out the logic analyser (Open Workbench Logic Sniffer), and I end up seeing what my problem is. Basically, the compiler I'm using has badly optimised a small part of my code which is watching for a very short (1.6uS) pulse on a line to indicate I can sent the next bit of data.

I fixed that by writing a small bit of ASM code to watch for the pulse, and try it again. This time, success! The EnviR picks up my message, and displays the relevant info on it's screen.

There you go! Reverse engineering the Current Cost protocol!
__________________

Last edited by Aedan; 21st September, 2012 at 04:18 PM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 6th September, 2012, 09:09 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Right, some info on the data that's sent...

The RFM01 module used in the development board uses SPI to configure the transmitter, plus an FSK input and a nIRQ output. The RFM01 will pulse the nIRQ line for around 1.6uS when it's ready for the next bit to transmit. Apart from the preamble and header, you must manchester encode your data -IE, if you want to transmit a '1' bit, you need to send '10', if you want to transmit a '0' bit, you need to send '01'.

A electricity consumption message looks like
Code:
<Flag+addr><addr><Sensor1H><Sensor1L><Sensor2H><Sensor2L><Sensor3H><Sensor3L>
Flags+addr
7 Unit is in find mode for pairing
6 Unknown - setting in find mode prevents pairing
5 Not used
4 Not used
3-0 Address bit 11-8

addr
7-0 Address bits 7-0

SensorxH
7 Data valid indicator (1=valid data, 0=sensor not in use)
6-0 Data bits 8-14

SensorxL
7-0 Data bits 7-0

Note there are three sensors, so for electricity, that corresponds to three phases. In fact, if you send for all three sensors, the EnviR will indicate that it's picking up three sensors worth of data on the screen (IE three phase).


Transmission
When transmitting data, you need to have a preamble and header for the receiver to lock onto your message. The sequence you need to use is <0xAA><0x2D><0xD4> before the message.

Pairing
Before the EnviR can pick up a device, it needs to be paired - effectively made aware of the address of the unit. This seems to be done by manually putting the EnviR in pairing mode, and then the transmitter unit sends a number of messages in quick succession with bit 7 of the first address byte set.

Maximum sensor readings
Each sensor has a maximum value of 15bits, so 0x7FFF or 32,767Watts. As there are three sensors, you can transmit a maximum power 3* 0x7FF or 98,301Watts.

Reception
The Envir seems to hold onto it's displayed figures for about 45 seconds before blanking the screen. Other devices seem to send a message every 6 seconds or so.
__________________

Last edited by Aedan; 12th September, 2012 at 11:58 AM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 6th September, 2012, 09:16 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Now, the unit can also handle gas, oil and water, but I don't know what kind of messages those send. In my playing around with the message that is sent, I wasn't able to get anything other than electricity.

Also, the CurrentCost design is one way only - the EnviR can't transmit, so if a message is lost, tough.

My next trick will be cleaning up the C code I've got, adding some more code to read a DS1820 temperature sensor, and then maybe releasing it to the world!
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 6th September, 2012, 09:18 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Oh! Really important! The ICSP header on the dev board is NOT the standard Microchip pin out. You'll need to know how to wire a cable.

ISCP connector details
Code:
ISCP	CCDB
1	4 
2	1 
3	5 
4	3 
5	2
This shows the mapping from ICSP pins to the CC dev board pins, assuming that pin 1 is closest to the switch. Note that both rows of pins are identical, so it doesn't matter which you connect to.
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 6th September, 2012, 10:45 PM
chrisbard's Avatar
Benchmarker
 
Join Date: March 2003
Location: Earth
Posts: 8,252
Send a message via Yahoo to chrisbard

All I can say is WOW. When was the last time you slept?
__________________
I've heard that linux community came up with better implemented security in it's latest Linux Mint Gold version, it's actually preventing the user to log in, thus posing 0 risk in contamining the computer with malware! Well done to the open source community!

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 7th September, 2012, 01:28 AM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

This would be quite useful in an energy conscience world, Thank You Aedan.
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 7th September, 2012, 11:02 AM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Right - a picture of the Current Cost digital development board. I've labelled the pins on it - the ICSP header, the power supply (left hand side), and the sensor input (right hand side) and the pulldown resistor on the sensor input. For one of the things I want to do, I'm going to have to remove it.
Attached Thumbnails
Hacking CurrentCost Energy Monitor-ccdigitaldevboard.jpg  
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #8 (permalink)  
Old 12th September, 2012, 12:53 AM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

No matter how hard I stare it isn't removing?

(In case you need a bit of incentive?":O}
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #9 (permalink)  
Old 12th September, 2012, 12:07 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

The EnviR can also handle oil, gas and water monitoring, although it doesn't actually display the info on the screen as far as I've been able to work out.

On the packet side of things, a general data message looks like
Code:
<Flag+addr><addr><0x00><SensorType><CountMSB><Count><Count><CountLSB>
Flags+addr
7 Unit is in find mode for pairing
6 Indicates data sensor type - set to 1
5 Not used
4 Not used
3-0 Address bit 11-8

addr
7-0 Address bits 7-0

Sensor Type
This indicates the sensor type. Currently supported sensors are:
  1. Not supported
  2. Electric
  3. Gas
  4. Water

Counter
This is a 32 bit DWORD that holds the current count of the sensor. This is an incrementing counter, so that the loss of a packet doesn't put out the overall figures.

Pairing
In data mode, pairing is very slightly different. When the pairing bit is set (bit 7), the Counter value should be set to the number of counts per unit. For water, gas and oil, this is cubic meters. For electricity, this is KWHr. This figure is what turns up in the IPU field in the XML output from the EnviR.
__________________

Last edited by Aedan; 12th September, 2012 at 12:08 PM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #10 (permalink)  
Old 12th September, 2012, 12:09 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Quote:
Originally Posted by Daniel ~ View Post
No matter how hard I stare it isn't removing
Need to finish cleaning up the code first!
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #11 (permalink)  
Old 12th September, 2012, 06:23 PM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

I figured the real action would be inside! ":O}
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #12 (permalink)  
Old 13th September, 2012, 09:13 AM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Well, I figured that with the information above, you'd be able to write your own code, the open source way.
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #13 (permalink)  
Old 14th September, 2012, 06:59 PM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

I did to! But once I began I realized...over time... that I didn't know where to start!
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #14 (permalink)  
Old 15th September, 2012, 01:44 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Here's some example code.
Attached Files
File Type: zip PIC16-CurrentCost.X.zip (19.8 KB, 266 views)
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #15 (permalink)  
Old 15th September, 2012, 05:40 PM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

I like this this part:

<?xml version="1.0" encoding="UTF-8"?>
<configurationDescriptor version="62">
<projectmakefile>Makefile</projectmakefile>
<defaultConf>0</defaultConf>
<confs>
<conf name="XC8" type="2">
<platformToolSN>:=MPLABCommUSB:=04D8:=0033:=0002:= Microchip Technology Inc.:=PICkit 2 Microcontroller Programmer:=?:=x:=en</platformToolSN>
<languageToolchainDir>C:\Program Files (x86)\Microchip\xc8\v1.10\bin</languageToolchainDir>
<mdbdebugger version="1">
<placeholder1>place holder 1</placeholder1>
<placeholder2>place holder 2</placeholder2>
</mdbdebugger>
<runprofile version="6">
<args></args>
<rundir></rundir>
<buildfirst>true</buildfirst>
<console-type>0</console-type>
<terminal-type>0</terminal-type>
<remove-instrumentation>0</remove-instrumentation>
<environment>
</environment>
</runprofile>
</conf>
</confs>
</configurationDescriptor>

Such pretty colors!
The pretty colors!! Where did they all go!? I guess only coders get to use the colors, is that how all this works? It's all....color coded? ":O}
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic


Last edited by Daniel ~; 15th September, 2012 at 05:44 PM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #16 (permalink)  
Old 16th September, 2012, 08:50 AM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

That's probably the config file for the IDE - it's an automatically generated file, so I don't need edit it or view it to be honest.

The colours you saw come from whatever you were using to view the file - although most IDEs will provide some colour coding to help the developer. I've attached a picture of the IDE to show the level of colour coding that I get. It does give me some useful stuff, like resource utilisation, as these devices don't have lots of memory. It has a total of 221 bytes of RAM, and space for 3459 instructions, of which I've used 35 bytes of RAM, and 637 instructions.
Attached Thumbnails
Hacking CurrentCost Energy Monitor-mplabx.png  
__________________

Last edited by Aedan; 16th September, 2012 at 08:53 AM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #17 (permalink)  
Old 16th September, 2012, 05:37 PM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

This is a world I will never enter, but seeing it from the outside and trying to relate it to the incredible complexity that is my OS...I get some sense what you guys must do the make the cyber world spin...and I'm in awe!
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic


Last edited by Daniel ~; 16th September, 2012 at 05:37 PM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #18 (permalink)  
Old 17th January, 2013, 06:21 PM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

Well, just for you Dan... That's the board with temperature and humidity sensor attached. Next step is to pick up the data from the energy monitor and do something useful with it!

Hacking CurrentCost Energy Monitor-img_00000003.jpg

This is an example XML message that comes out the other end:
Code:
<msg><src>CC128-v1.29</src><dsb>00283</dsb><time>18:08:44</time><tmpr>21.4</tmpr><sensor>8</sensor><id>03466</id><type>4</type><imp>0553704958</imp><ipu>0001</ipu></msg>
The long number (0553704958) contains the humidity data, the temperature data and a checksum. In this case, it's reading 33% humidity and 22.1C temperature.
__________________
Any views, thoughts and opinions are entirely my own. They don't necessarily represent those of my employer (BlackBerry).
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #19 (permalink)  
Old 18th January, 2013, 08:03 PM
Daniel ~'s Avatar
Chief BBS Administrator
 
Join Date: September 2001
Location: Seattle Wa.
Posts: 45,605

This is the part I think that messes with the most lay minds...How pretty colored code ends up actually controlling hard ware. Where numbers start doing things in the material world!.
__________________
"Though all men live in ignorance before mystery,
they need not live in darkness...
Justice is foundation and Mercy ETERNAL
."
DKE

"All that we do is touched by Ocean
Yet we remain on the shore of what we know."
Richard Wilbur

[img]/forum/attachments/random-nonsense/16515-sigs-dan_drag.jpg[/img]
Subscribers! Ask Pitch about a Custom Sig Graphic

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #20 (permalink)  
Old 8th October, 2014, 01:11 PM
Member
 
Join Date: October 2014
Posts: 2

Envir

Hi, just joined this forum.

I have a pair of the current cost clip on current transformers a transmitter unit and an ENVI display unit. I have on CT one the feed into the house so get the consumption that way. I hope to use the other CT on the output from my solar PV inverter so that I know what I'm generating. Ultimately I want to calculate the difference so that all surplus generation can be dumped into my water heater rather than give it to the grid.

I have looked at the XML message sent continuously by the ENVIR display and the History XML message invoked by pressing down arrow and OK buttons together. I could feed the contiuous message into another SBC to do the calculations but that seems to be over the top. The ENVIR has the capability of addressing the LCD display and storing 30 days worth of data and handling a number of electricity price tariffs so should be possible to reprogram to do what I want. Any info on the ENVIR display code, processor, memory and hardware would be appreciated. My set is badged as EON but the boards inside are Current Cost. The Current Cost Forum seems to be closed and they dont seem to want to help.

Thanks,

Martin
__________________

Last edited by parcdulas; 8th October, 2014 at 07:07 PM. Reason: correction
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply

Tags
energy saving



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Bloom Energy Unveils Energy "Servers", Looks to Revolutionize Power Industry Daniel ~ Random Nonsense! 6 28th February, 2010 07:53 PM
Bloom box: An energy breakthrough? PorPorMe Random Nonsense! 2 23rd February, 2010 01:21 AM
Powermeter: Google's household energy monitor arrives in UK danrok Random Nonsense! 4 3rd November, 2009 09:41 PM
Someone Else Is Hacking For Us! QSDT Hardware Hacking 35 5th February, 2006 02:42 AM
Hacking this VGA Byte Burner Graphics and Sound cards; Speakers and other Peripherals 0 21st December, 2005 08:05 PM


All times are GMT +1. The time now is 06:19 AM.


Copyright ©2001 - 2010, AOA Forums
Don't Click Here Don't Click Here Either

Search Engine Friendly URLs by vBSEO 3.3.0