RECESSIM - User contributions [en]

Industrial

2025-07-12T21:16:46Z

HLL:

[[File:BG Model 250 Side 1.JPG|thumb|Fluid control valves for acid in integrated circuit decapping machine]]
Access Control, Camera Systems, Infrastructure (Power, Gas and Water Meters), SCADA and any other industrial systems.
==Device Index==
[[Advanced Metering Infrastructure]]

[[Power Metering in Germany]]

[[B&G International Decapsulator Model 250]]

[[Digitech-XC0324]]

[[Electronic Parking Meter]]

[[Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem]]

[[LMS-6 Radiosonde]]

[[DFM-17 Radiosonde]]

[[Master Meter 3G Mobile AMR]]

[[Parking_Pilot]]

[[Telematics Wireless FP300RA]] - Automatic Vehicle Identification Reader

[[CD&F (Siren Controller)]]

[[Panasonic Toughpad FZ-G1 MK4]] - Industrial portable field tablet.

[[Maxon Data Radio]] - Low powered VHF/UHF radio module for SCADA/telemetry

[[Lantronix MSS100]] - Serial to Ethernet interface

[[Cytofluor 4000|CytoFluor 4000]] - Well plate reader

[[Miltel SpeedRead STx]] - Water meter AMR transmitter attachment

Industrial

2025-07-12T21:16:16Z

HLL:

Miltel SpeedRead STx

2025-07-12T21:10:31Z

HLL: Blog post ref

Miltel External Pulsed-readers (Transmitter)

For research process, see this [https://hlltech.blogspot.com/2021/09/reverse-engineering-wireless-water.html blog post - Reverse engineering wireless water meter network]

=Device=
Device is a separated unit from the actual meter, Enclosed there’s a Battery a pcb with a PIC microcontroller (firmware-read protected) and an FM encoder
Each device can be hooked up to at least 4 (possibly more) sensor, which in turn are connected to the meter
[https://store.abtwater.com/cdn/shop/products/IMG_0196.JPG Example Photo]
=Operation=
Each probe contains a reed switch and it is pulsed by the meter’s spinner on each full cycle. The meter can count it individually and according to the configured time, transmit this information wirelessly to either the repeater (re-transmits the same signal) or the concentrator (uploads the information to the system’s backend) installed in the area.

=Wireless communication=
This device can only transmit
==Frequency==
Frequency varies according to the installation, location and use-case
==Modulation==
The data is first encoded by the microcontroller as 0 meaning a PWM wave of a given frequency, and 1 given by a PWM in another frequency<ref> [https://lists.gnu.org/archive/html/discuss-gnuradio/2017-07/msg00097.html GNU Radio Mailing list message]</ref>.
The output of the microcontroller is then fed to the frequency modulator and transmitted OTA.
In order to demodulate, someone would have to perform FM demod, twice <ref>[https://lists.gnu.org/archive/html/discuss-gnuradio/2017-07/msg00162.html GNU Radio Mailing list message]</ref> (once for FM demod, and the latter for PWM demod, this can also be correlated instead) and should get the expected outcome.

==Protocol==
By reverse engineering, protocol possibly contain “fields” of arbitrary data; these fields are assembled from the decoded bit stream, in such a way that the next bit is either 16 or 20 bits after the former.
I.E. Lets assume the demodulated bits are D0…Dn, Then “Field 1” would be comprised out of D0, D16, D36, D52, D72, etc…
At least the meter id can be extracted this way, possibly more data as well.
There is also some data stuffing involved, I suggest seing the examples in this github ticket for how to decode [https://github.com/cla01/rtlsdr-test1/issues/1 github issue with code]

=Further information=
Technical information from the author in this github issue, and blog-post
Miltel Tech sheet - [https://www.speedreadtech.com/Product-Distribution/SpeedRead%20Stx%20Sheet%2001-08-2006.pdf], [https://www.speedreadtech.com/products/transmitter/]
Other Names: SpeedRead Networks, Datasense AMR
FCC ID: MLLSPEEDHPTX450 Possibly others as well
<references />

Miltel SpeedRead STx

2025-07-12T21:06:42Z

HLL: Created page with "Miltel External Pulsed-readers (Transmitter) =Device= Device is a separated unit from the actual meter, Enclosed there’s a Battery a pcb with a PIC microcontroller (firmwar..."

Miltel External Pulsed-readers (Transmitter)

=Device=
Device is a separated unit from the actual meter, Enclosed there’s a Battery a pcb with a PIC microcontroller (firmware-read protected) and an FM encoder
Each device can be hooked up to at least 4 (possibly more) sensor, which in turn are connected to the meter
[https://store.abtwater.com/cdn/shop/products/IMG_0196.JPG Example Photo]
=Operation=
Each probe contains a reed switch and it is pulsed by the meter’s spinner on each full cycle. The meter can count it individually and according to the configured time, transmit this information wirelessly to either the repeater (re-transmits the same signal) or the concentrator (uploads the information to the system’s backend) installed in the area.

=Wireless communication=
This device can only transmit
==Frequency==
Frequency varies according to the installation, location and use-case
==Modulation==
The data is first encoded by the microcontroller as 0 meaning a PWM wave of a given frequency, and 1 given by a PWM in another frequency<ref> [https://lists.gnu.org/archive/html/discuss-gnuradio/2017-07/msg00097.html GNU Radio Mailing list message]</ref>.
The output of the microcontroller is then fed to the frequency modulator and transmitted OTA.
In order to demodulate, someone would have to perform FM demod, twice <ref>[https://lists.gnu.org/archive/html/discuss-gnuradio/2017-07/msg00162.html GNU Radio Mailing list message]</ref> (once for FM demod, and the latter for PWM demod, this can also be correlated instead) and should get the expected outcome.

==Protocol==
By reverse engineering, protocol possibly contain “fields” of arbitrary data; these fields are assembled from the decoded bit stream, in such a way that the next bit is either 16 or 20 bits after the former.
I.E. Lets assume the demodulated bits are D0…Dn, Then “Field 1” would be comprised out of D0, D16, D36, D52, D72, etc…
At least the meter id can be extracted this way, possibly more data as well.
There is also some data stuffing involved, I suggest seing the examples in this github ticket for how to decode [https://github.com/cla01/rtlsdr-test1/issues/1 github issue with code]

=Further information=
Technical information from the author in this github issue, and blog-post
Miltel Tech sheet - [https://www.speedreadtech.com/Product-Distribution/SpeedRead%20Stx%20Sheet%2001-08-2006.pdf], [https://www.speedreadtech.com/products/transmitter/]
Other Names: SpeedRead Networks, Datasense AMR
FCC ID: MLLSPEEDHPTX450 Possibly others as well

File:Cereniti AMR Tx device.webp

2025-07-12T21:06:09Z

HLL: Cereniti networks AMR device (reader/transmitter)

== Summary ==
Cereniti networks AMR device (reader/transmitter)
== Licensing ==
{{subst:No license from license selector|Don't know}}

Miltel

2025-07-12T20:51:56Z

HLL: Proper name of STx device with link

=AMR Devices=
Miltel Communications Ltd. Has at least 2 generations of AMR Readers/Meter

* [[Miltel SpeedRead STx]] - External Readers via pulsed-interface. Also used in [[Cereniti]]
* [[Dorot MJ Series]] with embedded meter. Meter itself manufactured by "Dorot Control Valves". Houses Miltel Electronics for AMR.

Miltel

2025-07-09T08:05:55Z

HLL: Overview of Miltel's AMR Solutions

=AMR Devices=
Miltel Communications Ltd. Has at least 2 generations of AMR Readers/Meter

* [[Dorot MJ Series]] with embedded meter. Meter itself manufactured by "Dorot Control Valves". Houses Miltel Electronics for AMR.
* External Readers via pulsed-interface. Also used in [[Cereniti]]