RECESSIM - User contributions [en]

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-28T18:15:30Z

Ctag: Link to home assistant thread.

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

===Device Info===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

*The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
**Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads]. Or it means Remote disconnect.
*Capable of remote disconnect.
**So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
*Built-in tamper detection
*OTA firmware updates (Cell? Mesh?)
*Some models have an optical port? IR?
*Two variations: Modular and Integrated.
**Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
**Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D

FCC ID: https://fcc.report/FCC-ID/TEB-HUNTSU864

This meter won't be supported in rtlamr: https://github.com/bemasher/rtlamr/discussions/191

Draft HUNTSU864 manual: https://www.cleancss.com/user-manuals/TEB/-HUNTSU864

Meters without the top sticker do not have radios, apparently: https://www.landisgyr.com/webfoo/wp-content/uploads/2014/08/Info-Sheet-Focus-AX-Family.pdf Home Assistant thread on this meter model: https://community.home-assistant.io/t/monitoring-a-landis-gyr-axre-sd/704918

 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-28T18:14:04Z

Ctag: Link to non-communicating description pdf.

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

===Device Info===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

*The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
**Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads]. Or it means Remote disconnect.
*Capable of remote disconnect.
**So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
*Built-in tamper detection
*OTA firmware updates (Cell? Mesh?)
*Some models have an optical port? IR?
*Two variations: Modular and Integrated.
**Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
**Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D

FCC ID: https://fcc.report/FCC-ID/TEB-HUNTSU864

This meter won't be supported in rtlamr: https://github.com/bemasher/rtlamr/discussions/191

Draft HUNTSU864 manual: https://www.cleancss.com/user-manuals/TEB/-HUNTSU864

Meters without the top sticker do not have radios, apparently: https://www.landisgyr.com/webfoo/wp-content/uploads/2014/08/Info-Sheet-Focus-AX-Family.pdf 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-28T18:12:23Z

Ctag: Added link to draft manual pdf

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

===Device Info===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

*The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
**Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads]. Or it means Remote disconnect.
*Capable of remote disconnect.
**So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
*Built-in tamper detection
*OTA firmware updates (Cell? Mesh?)
*Some models have an optical port? IR?
*Two variations: Modular and Integrated.
**Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
**Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D

FCC ID: https://fcc.report/FCC-ID/TEB-HUNTSU864

This meter won't be supported in rtlamr: https://github.com/bemasher/rtlamr/discussions/191

Draft HUNTSU864 manual: https://www.cleancss.com/user-manuals/TEB/-HUNTSU864 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-28T18:11:09Z

Ctag: added link to rtlamr github issue

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

===Device Info===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

*The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
**Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads]. Or it means Remote disconnect.
*Capable of remote disconnect.
**So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
*Built-in tamper detection
*OTA firmware updates (Cell? Mesh?)
*Some models have an optical port? IR?
*Two variations: Modular and Integrated.
**Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
**Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D

FCC ID: https://fcc.report/FCC-ID/TEB-HUNTSU864

This meter won't be supported in rtlamr: https://github.com/bemasher/rtlamr/discussions/191 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-28T18:09:57Z

Ctag: added fcc id

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

===Device Info===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

*The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
**Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads]. Or it means Remote disconnect.
*Capable of remote disconnect.
**So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
*Built-in tamper detection
*OTA firmware updates (Cell? Mesh?)
*Some models have an optical port? IR?
*Two variations: Modular and Integrated.
**Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
**Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D

FCC ID: https://fcc.report/FCC-ID/TEB-HUNTSU864 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-23T03:23:19Z

Ctag: /* Device Info */ Added remote disconnect idea.

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

===Device Info===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

*The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
**Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads]. Or it means Remote disconnect.
*Capable of remote disconnect.
**So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
*Built-in tamper detection
*OTA firmware updates (Cell? Mesh?)
*Some models have an optical port? IR?
*Two variations: Modular and Integrated.
**Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
**Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D
 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-23T03:21:01Z

Ctag: Added initial set of device info from OEM webpage.

===ExecSum===
[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]][[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
My local utility company installed one of these doohickies on the house, and now I want to get realtime data from it after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article].

=== Device Info ===
The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Here is the official landing page for this family of products: https://www.landisgyr.com/product/focus-axe-axre-rxre-platform/

From this page I gather:

* The base product is called FOCUS AX. The AX'''e''' is a product refresh with better specs.
** Still no lead on the 'R' or '-SD' portions of AXRe-SD. I suspect 'R' is for reactive, as in it can meter [https://www.theelectricalguy.in/tutorials/active-reactive-apparent-power-easiest-explanation/ reactive loads].
* Capable of remote disconnect.
** So as a consumer, I have an interest in these devices both giving me the data I want, but not being imminently pwnable.
* Built-in tamper detection
* OTA firmware updates (Cell? Mesh?)
* Some models have an optical port? IR?
* Two variations: Modular and Integrated.
** Modular: with or without AMI comms (AMI is Advanced Metering Infrastructure, but I'm not sure if this means ZigBee, 802.15.4, or something else?)
** Integrated: With radio built-in (I assume radio != AMI comms?)

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D
 
===Packet Captures===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-23T02:54:56Z

Ctag: Added intro and images.

[[File:PXL 20240920 184927492.MP.jpg|border|thumb|FCC ID: TEB-HUNTSU864, GRIDSTREAM RF]]

=== ExecSum and Device Info ===
[[File:PXL 20240920 184923808.MP.jpg|thumb|Type: FOCUS AXRe-SD, FORM 2S CL200]]
Ctag's local utility company installed one of these doohickies on his house. And now after reading [https://pdx.su/blog/2024-03-17-reading-my-electric-meter-with-rtlsdr/ this article] he wants to get realtime energy data from it for HomeAssistant.

The smart meter in question: <code>Landis+Gyr FOCUS AXRe-SD FORM 2S CL200</code>

Hash sent this link in discord, showing that the 'e' variants should have increased microcontroller specs: https://documents.dps.ny.gov/public/Common/ViewDoc.aspx?DocRefId=%7BBE3EBED1-4973-440D-A2BD-A28ED46F9FC1%7D
 
=== Packet Captures ===
{| class="wikitable"
|+0x55 Captured packets from Meter 40DA952B, compared with reference
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}

----

File:PXL 20240920 184923808.MP.jpg

2024-09-23T02:36:55Z

Ctag:

Image of lower sticker on Gr smart meter.

File:PXL 20240920 184927492.MP.jpg

2024-09-23T02:34:55Z

Ctag:

Image of top sticker on Gr smart meter.

User:Ctag/Landis+Gyr Focus AXRe-SD

2024-09-23T02:31:03Z

Ctag: Copied over initial 0x55 packet table.

{| class="wikitable"
|+0x55 Captured packets from Meter 5021D005 (Coserv)
! rowspan="3" |Pkt
!0
!1
!2
!3
!4
!5
!6
!7
!8
!9
!10
!11
!12
!13
!14
!15
!16
|-
! colspan="4" |Not part of CRC calc
! colspan="9" |Data Packet
! colspan="3" |Trailing 6 Bytes
!
|-
!Start of
Frame
!Type
!SubType
!Length
!Unknown
!Unknown
!WAN Address
!Counter
!Uptime
!Unknown
!LAN Address
!Unknown
!Unknown
!Timing
(0.01 increments)
!Unknown
!Checksum
!Trailing
|-
! colspan="18" |Examples
|-
!1
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|7C
|'''0003FB20'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1E56
|7E00
|9032
|04
|-
!2
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|AE
|'''0003FB9E'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|0DA8
|7E00
|83E8
|04
|-
!3
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE5021D00500
|B8
|'''0003FBC1'''
|A403
|5021D005
|'''0100'''
|'''072001'''
|1B54
|7E00
|2924
|04
|-
! colspan="18" |HVAC Running
|-
!6
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|7E
|'''006D627B'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|147E
|7E00
|F2B5
|XX
|-
! colspan="18" |HVAC Off
|-
!7
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA952B00
|3A
|'''006D6381'''
|A40B
|40DA952B
|'''0100'''
|'''161505'''
|052E
|7E00
|0A80
|XX
|-
! colspan="18" |Someone else's meter?
|-
!8
|00FF
|2A
|55
|0023
|30
|FFFFFFFFFFFF
|FE40DA235100
|00
|'''006D65A4'''
|A40B
|40DA2351
|'''0100'''
|'''161505'''
|0B32
|7E00
|3FB7
|XX
|}
----