ESP8266/ESP32 decrypts wireless MBus frames from a Multical21 water meter.
The hardware you need:
- ESP8266 or ESP32 - i took an ESP8266 D1 mini clone.
- CC1101 module for 868 MHz
- some wires
The CC1101 868 MHz module is connected via SPI to the ESP8266/ESP32.
The best approach to build this software is using PlatformIO. If you are not familiar with PlatformIO, here is a good place to start.
The Multical21 is transmitting encrypted MBus frames (Mode C1, frame type B) every 16 seconds. The ESP8266/ESP32 does some validation (correct serial number, crc checking) and then decrypts them with AES-128-CTR.
The Multical21 provides the following meter values:
- total counter - total water consumption in m³
- target counter - water consumption until 1. day of the current month
- medium temperature - in °C
- ambient temperature - in °C
- info codes - BURST, LEAK, DRY, REVERSE, TAMPER, RADIO OFF
The ESP8266/ESP32 prints out the current meter values via UART (baudrate: 115200). The UART output looks something like this:
total: 1636.265 m³ - target: 1624.252 m³ - 13 °C - 22 °C - 0x00
Additionally the meter values are sent via MQTT to a given broker.
Rename config_template.h to config.h and fill in some information.
The serial number (8 digits) is printed on the water meter (above the LCD). Ask your water supplier for the decryption key (16 bytes). I got mine packed in a so called KEM-file. To extract the key i used a python script kem-decryptor.py
Provide your water meter serial number and decryption key in config.h:
// ask your water supplier for your personal encryption key
#define ENCRYPTION_KEY 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF
// serial number is printed on your multical21
#define SERIAL_NUMBER 0x63, 0x00, 0x05, 0x43
Provide your wifi credentials (ssid, password). Add your optional MQTT broker ip address. If your broker uses authentication add MQTT username/password.
// "ssid", "wifi_passphrase", "mqtt_broker", "mqtt_username", "mqtt_password"
std::vector<CREDENTIAL> const credentials = {
{ "ssid1", "********", "10.0.0.1", "mqttuser", "********"}
You can provide multiple wifi configurations:
// more than one wifi credentials are supported, upper one wins
// "ssid", "wifi_passphrase", "mqtt_broker", "mqtt_username", "mqtt_password"
std::vector<CREDENTIAL> const credentials = {
{ "ssid1", "********", "", "", ""} // no MQTT
, { "ssid2", "********", "10.14.0.1", "", ""} // MQTT without auth
, { "ssid3", "********", "10.0.0.111", "mqttuser", "********"} // MQTT with auth
};
Change the MQTT prefix and the topic names as you like. Currently the water counter value is published in watermeter/0/total and so on.
#define MQTT_PREFIX "watermeter/0"
#define MQTT_total "/total"
#define MQTT_target "/target"
#define MQTT_ftemp "/flowtemp"
#define MQTT_atemp "/ambienttemp"
#define MQTT_info "/infocode"
| CC1101 | ESP8266 | ESP32 |
|---|---|---|
| VCC | 3V3 | 3V3 |
| GND | GND | GND |
| CSN | D8 | 4 |
| MOSI | D7 | 23 |
| MISO | D6 | 19 |
| SCK | D5 | 18 |
| GDO0 | D2 | 32 |
| GDO2 | not connected | not connected |
Thanks to weetmuts for his great job on the wmbusmeters.