RECESSIM - User contributions [en]

Landis+Gyr GridStream Protocol

2021-05-14T01:29:26Z

Aero: Uploaded capture data

[[File:LandisGyrResidentialMeter1.JPG|thumb]]

==Protocol Analysis==
Analysis and decoding of the packets used on the Landis+Gyr GridStream mesh network.
 
===Packet Structure===

====Sync and Header====
----The sync word that the Landis+Gyr smart meters send is shown below, this can be used in GNU Radio or other tools to receive only packets transmitted by the meters. Note that at the start of the header we begin using start and stop bits. These must be stripped off of the rest of the data packet during processing.
{| class="wikitable"
|+Sync and Header
! colspan="6" |Sync
! colspan="3" |Header
|-
!0xAA
!0xAA
!0xAA
!0xAA
!0xAA
!0xA
!0x00
!0xFF
!0x2A
|-
|10101010
|10101010
|10101010
|10101010
|10101010
|1010
|0 '''00000000''' 1
|0 '''11111111''' 1
|0 '''00101010''' 1
|}
Using GNU Radio it was found that shortening the Sync requirements a bit and incorporating part of the header leads to the cleanest data for further downstream processing. The modified sync shown in 8 bit chunks is shown below.
{| class="wikitable"
|+Sync Word used with GNURadio
!0xAA
!0xAA
!0xAA
!0xAA
!0xA0
!0x05
!0xFF
|-
|10101010
|10101010
|10101010
|10101010
|10100000
|00000101
|11111111
|}
The final byte of the sync (0x2A) along with it's start and stop bits are discarded as part of the processing.
---- 
====Type, Length and Sub Type====
----So far only two types of packets have been observed, a 0x55 and a 0xD5 packet. Multiple lengths and SubTypes of these are listed below.
{| class="wikitable"
|+
!
!Type
!Length
!SubType
!Packets Purpose
|-
!1
|0x55
|0x0023
|0x30
|Report up-time and other unknown data
|-
!2
|0x55
|0x0028
|0x30
|
|-
!3
|0xD5
|0x0011
|0x21
|
|-
!4
|0xD5
|0x0011
|0x22
|
|-
!5
|0xD5
|0x0011
|0x29
|
|-
!6
|0xD5
|0x0016
|0x21
|
|-
!8
|0xD5
|0x0016
|0x29
|
|-
!7
|0xD5
|0x0017
|0x21
|
|-
!9
|0xD5
|0x0017
|0x29
|
|-
!10
|0xD5
|0x001C
|0x21
|
|-
!11
|0xD5
|0x001C
|0x29
|
|-
!12
|0xD5
|0x001D
|0x29
|
|-
!13
|0xD5
|0x0047
|0x51
|
|-
!14
|0xD5
|0x00FD
|0xC0
|
|}
 
---- 
====Data====
----Data varies per packet type but a common theme is the 0x55 packets appear to be broadcasts from the meters with only their own ID. 0xD5 packets usually contain two ID's and appear to be how data is routed across the network. Sometimes one of the meter ID's in a 0xD5 packet is FFFFFFFF which may be a broadcast packet. This was observed when packets were sent that appear to be updating the system time of the meters.
---- 
====Checksum====
----
C++ source code below used to calculate the CRC, different energy providers use a different initial CRC value. Assume this is to segment traffic, unsure if Routers/Collectors are shared by different providers to return traffic or not.

<syntaxhighlight lang="c++">
uint16_t Landis_crc16 (uint16_t crc, const std::vector<uint8_t> &data, size_t size) {
// CoServ CRC = 0x45F8
// Oncor CRC = 0x5FD6
// Hard coded Poly 0x1021
uint16_t i = 0;
while (size--) {
crc ^= data[i] << 8;
i++;
for (unsigned k = 0; k < 8; k++)
crc = crc & 0x8000 ? (crc << 1) ^ 0x1021 : crc << 1;
}
return crc;
}
</syntaxhighlight>
----

===Captured Meter Data===
There have been two packet types observed thus far, a 0x55 and a 0xD5 packet.

*0x55 appears to be broadcasts from the meters and happen frequently. They have been observed multiple times per minute from a single meter.

*0xD5 appears to be a packet for transporting data across the mesh network. Each D5 packet will contain two meter ID's, Meter ID #1 and Meter ID #2. There are many 0xD5 packet length and types that have been observed, some are shown below.

----

====0x55 Meter Data====
The data below was captured from the same meter (F0EE36DB) and shows some of the values that can change with each transmission. Different meters have different fixed data and some of the data changes less frequently as well.
{| class="wikitable"
|+
0x55 Captured packets from Meter F0EE36DB (Oncor)
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="3" |Not part of CRC calc
! colspan="11" |Data
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
!1
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''0C'''
|'''0001ECBF'''
|A483
|F0EE36DB
|0100
|213204
|'''384F'''
|7E80
|0896
|04
|-
!2
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''16'''
|'''0001ECC6'''
|A483
|F0EE36DB
|0100
|213204
|'''3AC5'''
|7E80
|F47E
|04
|-
!3
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''2A'''
|'''0001ED05'''
|A483
|F0EE36DB
|0100
|213204
|'''1207'''
|7E80
|A412
|04
|-
!4
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''34'''
|'''0001ED29'''
|A483
|F0EE36DB
|0100
|213204
|'''1FF9'''
|7E80
|D9C4
|04
|-
!5
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''38'''
|'''0001ED37'''
|A483
|F0EE36DB
|0100
|213204
|'''2571'''
|7E80
|963C
|04
|-
!6
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''42'''
|'''0001ED5C'''
|A483
|F0EE36DB
|0100
|213204
|'''33A9'''
|7E80
|8384
|04
|-
!7
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''4C'''
|'''0001ED60'''
|A483
|F0EE36DB
|0100
|213204
|'''354D'''
|7E80
|2CB6
|04
|-
!8
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''4E'''
|'''0001ED79'''
|A483
|F0EE36DB
|0100
|213204
|'''3F25'''
|7E80
|871A
|04
|-
!9
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''60'''
|'''0001EDA6'''
|A483
|F0EE36DB
|0100
|213204
|'''0F05'''
|7E80
|25C9
|04
|-
!10
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|50CF8DD9E2C0
|'''6A'''
|'''0001EDCD'''
|A483
|F0EE36DB
|0100
|213204
|'''1E55'''
|7E80
|F33F
|04
|}
[[File:55 Packet Timing Analysis.png|thumb|600x600px|Field 15 Timing Analysis -Anonymous]]
Commentary on the data fields above, they have been grouped based on sample analysis but this could be wrong. If you see a new pattern not noticed before you may be correct.

*Field 5 - Never observed a packet with this length and subtype that wasn't all FF's

*Field 6 - WAN Address - Oncor uses GPS coordinates, CoServ uses LAN with padding of some kind. The open source [https://github.com/beroset/gpsdecode gpsdecode] library shows one way to translate between WAN Address and GPS coordinates.

*Field 7 - Increments some amount with each transmission and rolls over at 0xFF, always an even hex value

*Field 8 - Value in seconds since meter powered on, '''easy way to see last time the meter experienced a power outage.'''
*Field 10 - LAN Address, Meter ID that's listed on the sticker on the front

'''** NEW **'''

'''Field 13''' - Timing in hundredths of a second, counts from 0 to 167.99 (0x419F) seconds then rolls over to 0 again. Credit for this discovery goes to an anonymous reader who examined the dataset at the bottom of the page!!
{| class="wikitable"
|+0x55 Captured packets from Meter 5021D005 (Coserv)
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="3" |Not part of CRC calc
! colspan="11" |Data
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
!1
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
!4
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|C0
|'''0003FC30'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|052E
|7E00
|09FC
|04
|-
!5
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|EA
|'''0003FC9F'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|3062
|7E00
|C69A
|04
|-
! colspan="17" |Power restored after an outage
|-
!6
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|06
|'''0000000F'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|26DA
|7E30
|90CE
|04
|-
!7
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|0E
|'''0000000F'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|26EF
|7E10
|2740
|04
|-
!8
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|20
|'''00000011'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2801
|7E90
|8B23
|04
|-
!9
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|2C
|'''00000013'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2883
|7E60
|1A1A
|04
|-
!10
|00FF2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|54
|'''00000017'''
|A403
|5021D005
|'''01EA'''
|'''6000FE'''
|2A72
|7E80
|E3CD
|04
|}
----

====0xD5 Meter Data====
There appear to be multiple packet lengths and styles for the 0xD5 packet. Some samples shown below.
{| class="wikitable"
|+0xD5 Captured packets
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
|-
! colspan="3" |Not part of CRC calc
! colspan="7" |Data
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Meter ID #1
!Meter ID #2
!Unknown
!Unknown
!Unknown
!Unknown
!Checksum
!Trailing
|-
|1
|00FF2A
|D5
|0016
|21
|F05FCB84
|F0FC4DB1
|E288
|0100
|273205
|00781930
|CB72
|00
|-
|2
|00FF2A
|D5
|0016
|21
|F0653657
|F03B9FFB
|7288
|0100
|1F3204
|2E241140
|B6B1
|00
|-
|3
|00FF2A
|D5
|0016
|21
|F0EF3BCE
|F03B9FFB
|6288
|0100
|1E3204
|23931730
|6DA6
|00
|-
|4
|00FF2A
|D5
|0016
|21
|F1419ADD
|F03B9FFB
|7C98
|0100
|1E3204
|332C1780
|BB3E
|00
|-
|5
|00FF2A
|D5
|0016
|21
|F07C5F0C
|F03B9FFB
|9A88
|0100
|1E3204
|018C1A80
|4FCF
|00
|}
 
{| class="wikitable"
|+0xD5 Packets where actual time along with uptime is observed
! rowspan="3" |Pkt
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
!17
|-
! colspan="3" |Not part of CRC calc
! colspan="12" |Data (Oncor Meter)
! colspan="2" |
|-
!Header
!Type
!Length
!SubType
!Meter ID1
!Meter ID2
!Counter
!Epoch Time
!Unknown
Reading?
!Uptime
!Unknown
!Unknown
!WAN Address
Meter ID2
!Meter ID2
!Unknown Data
!Checksum
!Trailing
|-
!1
|00FF2A
|D5
|0047
|51
|F0C00020
|F03B9FFB
|18
|'''60378AB1'''
|00033D56
|0006C31A
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602030705070704000000 04C2 C000 204C 0401 FA 2030208180 2163 1900
|75F3
|00
|-
!2
|00FF2A
|D5
|0047
|51
|F10679DE
|F03B9FFB
|1E
|'''60378C72'''
|00023F96
|0006C4DB
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602030705070704000000 0718 6800 204C 0401 FA 2030208180 0BF7 1D30
|CDB4
|00
|-
!3
|00FF2A
|D5
|0047
|51
|F159CD44
|F03B9FFB
|B4
|'''603A627C'''
|00028F50
|00099AE5
|A483
|0101
|50CFB5D9E400
|F03B9FFB
|000103240602020705070805000000 02A3 C800 1E6C 0401 D9 2030208180 226A 1A10
|7330
|00
|-
! colspan="4" |
! colspan="12" |Data (CoServ Meter)
! colspan="2" |
|-
!4
|00FF2A
|D5
|0047
|51
|F143250D
|5021D005
|1A
|'''603AD051'''
|000130D8
|000D10ED
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 02C3 0800 0E20 0200 E3 20301F8180 22F0 1C40
|4FEB
|00
|-
!5
|00FF2A
|D5
|0047
|51
|F143248A
|5021D005
|64
|'''603AD09C'''
|000133C6
|000D1138
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 0BA0 9000 0E20 0200 E3 20301F8180 4076 1150
|73A7
|00
|-
!6
|00FF2A
|D5
|0047
|51
|500F0DD6
|5021D005
|80
|'''603AD0D3'''
|000135EC
|000D116F
|A403
|0101
|FE5021D00500
|5021D005
|000103200000000000000000000000 01D8 A800 0E20 0200 E3 20301F8180 1412 2E40
|ADC1
|00
|}

*Epoch time calculator and explanation can be found [https://www.epochconverter.com/ here], first convert time from hex to decimal then input into converter.

<code>00FF2A D5 0016 21 F073B577 F062363D FA88 0100 1F6C04 14E93E70 CF80 04</code>

<code>00FF2A D5 0017 29 8073AEAC F0F28D56 1288 0100 1F3204 041CBB1930 2D2A 04</code>

<code>00FF2A D5 001B 21 F10679E2 8073CE7D F498 0100 106C02 0A15F9055F06571A80 37C5 00</code>

<code>00FF2A D5 001C 29 8073ADB3 8073CE7D 9088 0100 106C02 040A99CF055F3A4B1170 A696 04</code>

<code>00FF2A D5 0021 22 F05A1A60 8073CE7D D8010100106C020520301D81800A99CF055F3ADD1410 A560 04</code>

<code>00FF2A D5 0047 51 F05A4BCC F03D4CD7 5A 6032F37F 0001DA2E 00022BE9 A483 0101 50D075D9E2E0 F03D4CD7</code> <code>000103240403030806080801000000036EE8001F6C0401E9203020818018C22930 9294 00</code>
<references />

===Data captures===
'''''*Note: This file does not contain the trailing bytes shown in the captures above, it stops at the 16 bit Checksum.'''''

[https://wiki.recessim.com/w/images/d/d3/F03B9FFB.txt Oncor Meter - F03B9FFB - 48 hours capture]
{| class="wikitable"
|+Data Requests from SmartMeterTexas (F03B9FFB)
!Date
!Time
!Meter Read
!On Demand Energy Usage
|-
|03/01/2021
|14:31:08
|37641.426
|79.415
|-
|03/01/2021
|16:44:40
|37648.598
|37.441
|-
|03/01/2021
|22:14:01
|37658.906
|47.749
|-
|03/02/2021
|21:17:07
|37705.09
|44.071
|-
|03/02/2021
|21:22:58
|37705.234
|44.215
|}
This table lists Real-time data requests from [https://www.smartmetertexas.com/home SmartMeterTexas.com] which allows customers to request current meter readings. You will see 0xD5 packets in the data file closely linked to the times above. When the request is made on the website the meter generally responds within 10-15 seconds meaning the system can send a message to the mesh network, traverse across the meters and return fairly quickly.

===GPS Tagged Wardrive Files===
Format will likely change for the files as more is learned, currently the format is:
Meter_ID, Uptime(seconds), Uptime(days), GPS_Data($GPGGA)
[https://wiki.recessim.com/w/images/a/a6/Wardrive-NTX_to_Highland-Park-03-09-2021.csv Wardrive-NTX_to_Highland-Park-03-09-2021.csv]
Raw capture data:
[[File:RAW Capture NJ.txt.txt]]

File:RAW Capture NJ.txt.txt

2021-05-14T01:25:06Z

Aero:

Raw capture data

Gr-smart meters Setup Guide

2021-05-13T02:20:43Z

Aero: Moved Python prereqs to proper section

The following install guide details the steps from a fresh Ubuntu 20.04 install to a fully running GNU Radio + USRP B200, HackRF and RTL-SDR frequency hopping spread spectrum setup needed to capture smart meter data.

<youtube width="320" height="240">fUK8tcFQwpo</youtube>

==Install Ubuntu 20.04==
There is nothing special about Ubuntu, it was chosen because it works well across different computers and has a familiar interface. Likely these instructions can be used as a rough guide for what is needed with other distro's.

For now, this step is to install a base version of Ubuntu 20.04, mine was a minimal install. After finishing your install ensure you update everything.

<syntaxhighlight lang="bash">
sudo apt update
sudo apt upgrade
</syntaxhighlight>

===Install dependencies===
The block at the top is standard from the GNU Radio install guide. The two additional below are vim so you get nice colors in your editor and liborc which is needed for the additional GNU Radio blocks that will be installed.<syntaxhighlight lang="bash">
sudo apt install git cmake g++ libboost-all-dev libgmp-dev swig python3-numpy python3-mako python3-sphinx python3-lxml doxygen libfftw3-dev libsdl1.2-dev libgsl-dev libqwt-qt5-dev libqt5opengl5-dev python3-pyqt5 liblog4cpp5-dev libzmq3-dev python3-yaml python3-click python3-click-plugins python3-zmq python3-scipy python3-gi python3-gi-cairo gobject-introspection gir1.2-gtk-3.0 xterm
</syntaxhighlight><code>sudo apt install liborc-0.4-dev vim</code>

==Install GNU Radio 3.8==
This guide and the blocks used here are all dependent on GNU Radio 3.8. As 3.9 has been released for a while more blocks and packages are getting support so this guide may be updated in the future to support 3.9.<syntaxhighlight lang="bash">
sudo add-apt-repository ppa:gnuradio/gnuradio-releases-3.8
sudo apt update
sudo apt install gnuradio
</syntaxhighlight>

==For USRP B200 Support==
This is specific to the USRP B200 software defined radio, if you are using another SDR this will not be necessary.

===Install necessary packages===
<code>sudo apt install libuhd-dev libuhd3.15.0 uhd-host</code>

===Download firmware needed for different USRP devices===
If this doesn't work your files may have been installed in /usr/local/lib instead of /usr/lib

<code>sudo /usr/lib/uhd/utils/uhd_images_downloader.py</code>

===Configure USB and test USRP B200===
<syntaxhighlight lang="bash">
cd /usr/lib/uhd/utils/
sudo cp uhd-usrp.rules /etc/udev/rules.d/
sudo udevadm control --reload-rules
sudo udevadm trigger
uhd_usrp_probe
</syntaxhighlight>

==For HackRF Support==
===Install necessary packages===
<code>sudo apt install build-essential cmake libusb-1.0-0-dev pkg-config libfftw3-dev</code>
===Install HackRF from source===
<syntaxhighlight lang="bash">
git clone https://github.com/mossmann/hackrf.git
cd hackrf/host/
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
</syntaxhighlight>
===Install gr-osmosdr===
<syntaxhighlight lang="bash">
git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr/
git checkout gr3.8
mkdir build
cd build/
cmake ../
make
sudo make install
sudo ldconfig
</syntaxhighlight>

==For AirSpy Support==

===Install necessary packages===
<syntaxhighlight lang="bash">
sudo apt install libairspy0 libairspy-dev
</syntaxhighlight>

===Install gr-osmosdr===
<syntaxhighlight lang="bash">
git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr/
git checkout gr3.8
mkdir build
cd build/
cmake ../
make
sudo make install
sudo ldconfig
</syntaxhighlight>
==For RTL-SDR Support==
===Install RTL-SDR drivers===
Follow procedure to install RTL-SDR drivers: https://www.rtl-sdr.com/rtl-sdr-quick-start-guide/
Section: Getting Started on Linux
===Install gr-osmosdr===
<syntaxhighlight lang="bash">
git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr/
git checkout gr3.8
mkdir build
cd build/
cmake ../
make
sudo make install
sudo ldconfig
</syntaxhighlight>

==Install Frequency Hopping Utilities==
If you already have GNU Radio and your SDR setup you should start here to install the Sandia Laboratories out of tree (OOT) modules. Four different OOT modules are needed.

#[https://github.com/sandialabs/gr-pdu_utils PDU Utilities]
#[https://github.com/sandialabs/gr-fhss_utils FHSS Utilities]
#[https://github.com/sandialabs/gr-timing_utils Timing Utilities]
#[https://github.com/sandialabs/gr-sandia_utils Sandia Utilities]

===Create a folder to organize them===
<syntaxhighlight lang="bash">
cd
mkdir FHSS_Utils
cd FHSS_Utils
</syntaxhighlight>

===Install PDU Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-pdu_utils.git
cd gr-pdu_utils/
git checkout maint-3.8
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install FHSS Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-fhss_utils.git
cd gr-fhss_utils/
git checkout maint-3.8
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install Timing Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-timing_utils.git
cd gr-timing_utils/
git checkout maint-3.8
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install Sandia Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-sandia_utils.git
cd gr-sandia_utils/
git checkout maint-3.8
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

==Setup PYTHONPATH==
gnuradio-companion will give you errors if it can't find your python libraries that were just installed. Also highly suggest starting gnuradio-companion from a terminal as opposed to the icon in Ubuntu. It gives you a nice way to see console output and you have to configure path variables in other places to run gnuradio-companion with the icon.

#Figure out where your dist-packages is located
#Open your .bashrc file and add that path
#close all open terminals and re-open them

===Figure out where dist-packages is located===
If your system is like mine they will be in:

<code>/usr/local/lib/python3/dist-packages</code>

You can easily confirm by using "ls" to show all the files there, if you see folder names corresponding to the packages installed above you have the correct folder. If not, try searching for other occurrences of "dist-packages" on your system where they may have been placed.

===Edit .bashrc and add PYTHONPATH===
Add the following to the end of your .bashrc if there is no PYTHONPATH variable.

<code>export PYTHONPATH=/usr/local/lib/python3/dist-packages/</code>

====Finish up====
Close all open terminal windows and then open a new one.

==Setup gr-smart_meters==
This contains the GridStream block that will be used to decode Landis+Gyr Smart Meter data along with pre-configured flowgraphs for USRP B200, HackRF and RTL-SDR and a script to decode GPS data transmitted in some cases.
===Python 2.7 dependencies===
Current version of script which does GPS coordinates extraction requires Python 2.7 and numpy library installed.
<syntaxhighlight lang="bash">
curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
python2 get-pip.py
pip2 install numpy
</syntaxhighlight>
===Install gr-smart_meters===
<syntaxhighlight lang="bash">
git clone https://github.com/BitBangingBytes/gr-smart_meters.git
cd gr-smart_meters/
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
</syntaxhighlight>
===Start GNU Radio from a terminal window===
<code>gnuradio-companion</code>
===Open flowgraph for your SDR===
In GNU Radio open a flowgraph and navigate to the gr-smart_meters/flowgraph folder. If you have installed everything above you should be able to run it and see smart meter data!
==Determining your power providers CRC==
CRC check is set to false in the sample flowgraphs so you will see data but can't be sure there aren't any errors. Every power provider is assigned a unique CRC so neighboring smart meter systems do not interfere with each other. To determine this you need to capture at least 4 good packets and use reveng to reverse the CRC.
===Install reveng===
It's on sourceforge: https://reveng.sourceforge.io/
Documentation is at: https://reveng.sourceforge.io/readme.htm
Download the .zip in the latest releases folder: https://sourceforge.net/projects/reveng/files/2.1.1/
Follow instructions to make
===Provide reveng four good packets===
I find the easiest way to do this is to limit the '''Packet Type''' to 0x55 and '''Packet Length''' to 0x23. Edit the GridStream block and make those changes then run the flowgraph making sure '''CRC Enable''' is set to False.

You will get data that looks like this below.

<code>00FF2A55002330FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286</code>

You need to remove the first 6 bytes and provide the rest as inputs to reveng, CRC isn't calculated on those bytes.

<code>00FF2A550023 <-- Discard | 30FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286</code>

Now provide four samples to reveng

<code>./reveng -w 16 -s 30FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286 30FFFFFFFFFFFF50CF2DD9E560560065F5D5A483F0C000650100176C033FF77E901766 30FFFFFFFFFFFF50CF95D9E5E01A0065F5D9A483F0515A0201001E6C042A177E90BDA4 30FFFFFFFFFFFF50CF8DD9E6A0F00065F5EBA483F0EBFD4A0100206C0433A97E90B04C</code>

You should get the following output below if you used this data to test

<code>width=16 poly=0x1021 init=0x5fd6 refin=false refout=false xorout=0x0000 check=0x139e residue=0x0000 name=(none)</code>

The init value is what you enter into the GridStream block, you can now enable the CRC and know you have correct data!

Gr-smart meters Setup Guide

2021-05-12T23:32:43Z

Aero: 1. xterm is needed for gnuradio (not included in basic 20.04 install) 2. directory change need to be done twice to get out from build and project folders 3. numpy installation for Python 2.7 4. RTL-SDR drivers (should be installed before gr-osmosdr)

The following install guide details the steps from a fresh Ubuntu 20.04 install to a fully running GNU Radio + USRP B200, HackRF and RTL-SDR frequency hopping spread spectrum setup needed to capture smart meter data.

<youtube width="320" height="240">fUK8tcFQwpo</youtube>

==Install Ubuntu 20.04==
There is nothing special about Ubuntu, it was chosen because it works well across different computers and has a familiar interface. Likely these instructions can be used as a rough guide for what is needed with other distro's.

For now, this step is to install a base version of Ubuntu 20.04, mine was a minimal install. After finishing your install ensure you update everything.

<syntaxhighlight lang="bash">
sudo apt update
sudo apt upgrade
</syntaxhighlight>

===Install dependencies===
The block at the top is standard from the GNU Radio install guide. The two additional below are vim so you get nice colors in your editor and liborc which is needed for the additional GNU Radio blocks that will be installed.<syntaxhighlight lang="bash">
sudo apt install git cmake g++ libboost-all-dev libgmp-dev swig python3-numpy python3-mako python3-sphinx python3-lxml doxygen libfftw3-dev libsdl1.2-dev libgsl-dev libqwt-qt5-dev libqt5opengl5-dev python3-pyqt5 liblog4cpp5-dev libzmq3-dev python3-yaml python3-click python3-click-plugins python3-zmq python3-scipy python3-gi python3-gi-cairo gobject-introspection gir1.2-gtk-3.0 xterm
</syntaxhighlight><code>sudo apt install liborc-0.4-dev vim</code>

==Install GNU Radio 3.8==
This guide and the blocks used here are all dependent on GNU Radio 3.8. As 3.9 has been released for a while more blocks and packages are getting support so this guide may be updated in the future to support 3.9.<syntaxhighlight lang="bash">
sudo add-apt-repository ppa:gnuradio/gnuradio-releases-3.8
sudo apt update
sudo apt install gnuradio
</syntaxhighlight>

==For USRP B200 Support==
This is specific to the USRP B200 software defined radio, if you are using another SDR this will not be necessary.

===Install necessary packages===
<code>sudo apt install libuhd-dev libuhd3.15.0 uhd-host</code>

===Download firmware needed for different USRP devices===
If this doesn't work your files may have been installed in /usr/local/lib instead of /usr/lib

<code>sudo /usr/lib/uhd/utils/uhd_images_downloader.py</code>

===Configure USB and test USRP B200===
<syntaxhighlight lang="bash">
cd /usr/lib/uhd/utils/
sudo cp uhd-usrp.rules /etc/udev/rules.d/
sudo udevadm control --reload-rules
sudo udevadm trigger
uhd_usrp_probe
</syntaxhighlight>

==For HackRF Support==
===Install necessary packages===
<code>sudo apt install build-essential cmake libusb-1.0-0-dev pkg-config libfftw3-dev</code>
===Install HackRF from source===
<syntaxhighlight lang="bash">
git clone https://github.com/mossmann/hackrf.git
cd hackrf/host/
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
</syntaxhighlight>
===Install gr-osmosdr===
<syntaxhighlight lang="bash">
git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr/
git checkout gr3.8
mkdir build
cd build/
cmake ../
make
sudo make install
sudo ldconfig
</syntaxhighlight>

==For AirSpy Support==

===Install necessary packages===
<syntaxhighlight lang="bash">
sudo apt install libairspy0 libairspy-dev
</syntaxhighlight>

===Install gr-osmosdr===
<syntaxhighlight lang="bash">
git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr/
git checkout gr3.8
mkdir build
cd build/
cmake ../
make
sudo make install
sudo ldconfig
</syntaxhighlight>
==For RTL-SDR Support==
===Install RTL-SDR drivers===
Follow procedure to install RTL-SDR drivers: https://www.rtl-sdr.com/rtl-sdr-quick-start-guide/
Section: Getting Started on Linux
===Install gr-osmosdr===
<syntaxhighlight lang="bash">
git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr/
git checkout gr3.8
mkdir build
cd build/
cmake ../
make
sudo make install
sudo ldconfig
</syntaxhighlight>

==Install Frequency Hopping Utilities==
If you already have GNU Radio and your SDR setup you should start here to install the Sandia Laboratories out of tree (OOT) modules. Four different OOT modules are needed.

#[https://github.com/sandialabs/gr-pdu_utils PDU Utilities]
#[https://github.com/sandialabs/gr-fhss_utils FHSS Utilities]
#[https://github.com/sandialabs/gr-timing_utils Timing Utilities]
#[https://github.com/sandialabs/gr-sandia_utils Sandia Utilities]

===Create a folder to organize them===
<syntaxhighlight lang="bash">
cd
mkdir FHSS_Utils
cd FHSS_Utils
</syntaxhighlight>

===Install PDU Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-pdu_utils.git
cd gr-pdu_utils/
git checkout maint-3.8
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install FHSS Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-fhss_utils.git
cd gr-fhss_utils/
git checkout maint-3.8
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install Timing Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-timing_utils.git
cd gr-timing_utils/
git checkout maint-3.8
mkdir build
cd build
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

===Install Sandia Utilities===
<syntaxhighlight lang="bash">
git clone https://github.com/sandialabs/gr-sandia_utils.git
cd gr-sandia_utils/
git checkout maint-3.8
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
cd ../..
</syntaxhighlight>

==Setup PYTHONPATH==
gnuradio-companion will give you errors if it can't find your python libraries that were just installed. Also highly suggest starting gnuradio-companion from a terminal as opposed to the icon in Ubuntu. It gives you a nice way to see console output and you have to configure path variables in other places to run gnuradio-companion with the icon.

#Figure out where your dist-packages is located
#Open your .bashrc file and add that path
#close all open terminals and re-open them

===Figure out where dist-packages is located===
If your system is like mine they will be in:

<code>/usr/local/lib/python3/dist-packages</code>

You can easily confirm by using "ls" to show all the files there, if you see folder names corresponding to the packages installed above you have the correct folder. If not, try searching for other occurrences of "dist-packages" on your system where they may have been placed.

===Edit .bashrc and add PYTHONPATH===
Add the following to the end of your .bashrc if there is no PYTHONPATH variable.

<code>export PYTHONPATH=/usr/local/lib/python3/dist-packages/</code>

====Finish up====
Close all open terminal windows and then open a new one.

==Setup gr-smart_meters==
This contains the GridStream block that will be used to decode Landis+Gyr Smart Meter data along with pre-configured flowgraphs for USRP B200, HackRF and RTL-SDR and a script to decode GPS data transmitted in some cases.
===Install gr-smart_meters===
<syntaxhighlight lang="bash">
git clone https://github.com/BitBangingBytes/gr-smart_meters.git
cd gr-smart_meters/
mkdir build
cd build/
cmake ..
make -j8
sudo make install
sudo ldconfig
</syntaxhighlight>
===Start GNU Radio from a terminal window===
<code>gnuradio-companion</code>
===Open flowgraph for your SDR===
In GNU Radio open a flowgraph and navigate to the gr-smart_meters/flowgraph folder. If you have installed everything above you should be able to run it and see smart meter data!
==Determining your power providers CRC==
CRC check is set to false in the sample flowgraphs so you will see data but can't be sure there aren't any errors. Every power provider is assigned a unique CRC so neighboring smart meter systems do not interfere with each other. To determine this you need to capture at least 4 good packets and use reveng to reverse the CRC.
===Install reveng===
It's on sourceforge: https://reveng.sourceforge.io/
Documentation is at: https://reveng.sourceforge.io/readme.htm
Download the .zip in the latest releases folder: https://sourceforge.net/projects/reveng/files/2.1.1/
Follow instructions to make
===Provide reveng four good packets===
I find the easiest way to do this is to limit the '''Packet Type''' to 0x55 and '''Packet Length''' to 0x23. Edit the GridStream block and make those changes then run the flowgraph making sure '''CRC Enable''' is set to False.

You will get data that looks like this below.

<code>00FF2A55002330FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286</code>

You need to remove the first 6 bytes and provide the rest as inputs to reveng, CRC isn't calculated on those bytes.

<code>00FF2A550023 <-- Discard | 30FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286</code>

Now provide four samples to reveng

<code>./reveng -w 16 -s 30FFFFFFFFFFFF50CF5DD9E2C0B80065F5D1A483F0FBBC6F01001E6C043B517E90B286 30FFFFFFFFFFFF50CF2DD9E560560065F5D5A483F0C000650100176C033FF77E901766 30FFFFFFFFFFFF50CF95D9E5E01A0065F5D9A483F0515A0201001E6C042A177E90BDA4 30FFFFFFFFFFFF50CF8DD9E6A0F00065F5EBA483F0EBFD4A0100206C0433A97E90B04C</code>

You should get the following output below if you used this data to test

<code>width=16 poly=0x1021 init=0x5fd6 refin=false refout=false xorout=0x0000 check=0x139e residue=0x0000 name=(none)</code>

The init value is what you enter into the GridStream block, you can now enable the CRC and know you have correct data!

===Python 2.7 dependencies===
Current version of script which does GPS coordinates extraction requires Python 2.7 and numpy library installed.
<syntaxhighlight lang="bash">
curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
python2 get-pip.py
pip2 install numpy
</syntaxhighlight>