Kamstrup OMNIPOWER - THREE-PHASE METER

39 posts / 0 new
Last post
250266
Kamstrup OMNIPOWER - THREE-PHASE METER

Hi,
I' m new to this but managed to connect my Kamstrup meter to my laptops USB using a FTDI converter connected to the meter.
I use default settings. It connect and this dialog comes up : "You need to read Association view to see all objects what the meter can offer. Do you want to do it now?"

I say Yes and this error shows in log:

GXDLMSDirector 8.1.1901.1601
Log created 20:03:19
20:03:30 Initializing serial connection.
20:03:31 Send SNRM request.
7E A0 07 03 21 93 0F 01 7E
20:03:31
7E A0 20 21 03 73 73 98 81 80 14 05 02 00 80 06 02 00 80 07 04 00 00 00 01 08 04 00 00 00 01 CE 6A 7E
20:03:31 Parsing UA reply succeeded.
20:03:31 Send AARQ request.
7E A0 2B 03 21 10 FB AF E6 E6 00 60 1D A1 09 06 07 60 85 74 05 08 01 01 BE 10 04 0E 01 00 00 00 06 5F 1F 04 00 00 1E 1D FF FF C5 E4 7E
20:03:32
7E A0 39 21 03 30 2E D2 E6 E7 00 61 82 00 29 A1 09 06 07 60 85 74 05 08 01 01 A2 03 02 01 00 A3 05 A1 03 02 01 00 BE 10 04 0E 08 00 06 5F 1F 04 00 00 10 1D 03 EF 00 07 44 36 7E
20:03:32 Parsing AARE reply succeeded.
20:03:36 --- Collecting objects. ---
20:03:36 Collecting objects
7E A0 19 03 21 32 6F D8 E6 E6 00 C0 01 C1 00 0F 00 00 28 00 00 FF 02 00 91 53 7E
Data send failed. Try to resend 1/3
20:03:41 Data send failed. Try to resend 1/3
7E A0 19 03 21 32 6F D8 E6 E6 00 C0 01 C1 00 0F 00 00 28 00 00 FF 02 00 91 53 7E
20:03:41
7E A8 89 21 03 42 07 B9 E6 E7 00 C4 02 C1 00 00 00 00 01 00 82 00 88 01 2B 02 04 12 00 0F 11 02 09 06 00 00 28 00 00 FF 02 02 01 0B 02 03 0F 01 16 01 00 02 03 0F 02 16 01 00 02 03 0F 03 16 01 00 02 03 0F 04 16 01 00 02 03 0F 05 16 01 00 02 03 0F 06 16 01 00 02 03 0F 07 16 00 00 02 03 0F 08 16 01 00 02 03 0F 09 16 01 00 02 03 0F 0A 16 01 00 02 03 0F 0B 16 01 00 01 06 02 02 0F 01 16 00 02 02 0F 02 16 00 02 EC 3F 7E 7E A0 07 21 03 51 11 42 7E
Gurux.DLMS.GXDLMSException: ParseObjects failed. Invalid parameter.
at GXDLMSDirector.MainForm.RefreshDevice(GXDLMSMeter dev, Boolean bRefresh)
at GXDLMSDirector.MainForm.Refresh(Object sender, GXAsyncWork work, Object[] parameters)

Kurumi
Kurumi's picture

Hi,

Kamstrup OMNIPOWER is a little bit special case. You need to set MaxInfoRX and MaxInfoTX to 1010.
See pic below. If you want to use encrypted connections you need to select "Supported Services" tab and check "General Protection".

BR,

Mikko

Image: 

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

250266

Thanks. It worked :-)

Now I have to figure out what do do next.
My goal is to see the current watts drawm from each phase and I'm not sure how to do that?

Image: 
Kurumi
Kurumi's picture

Hi,

Kamstrup is using custom OBIS codes and not standard ones. You need to find correct OBIS codes from the meter manual or ask them from the meter vendor.

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

asbjoern

Hi, can you describe how you are using an ftdi to connect to the meter?
Are you using the optical eye or the CCC interface?
I am very interested in finding the best way to interface with the CCC connector.
Is it just a 3.3v UART?

250266

I'm using the 6 pin connector. PINs are like this
GND - DO - NC
VCC - DI - NC

VCC: supply out 4.15V max 75 mA
DI : 82kOhm pullup to 3.3V; 2,0 < High < 3.6V; 0V < Low < 0.8V
DO: Push/pull, < 1.2kohm impedans
NC: Do not connect

I bought the FTDI from aliexpress
https://www.aliexpress.com/item/Free-Shipping-FT232RL-FTDI-USB-3-3V-5-5V...

Remember move the jumber to 3.3V setting. Default is 5V.
I made a cable like on the picture.

Image: 
Kurumi
Kurumi's picture

Hi,

Thank you for this good explanation.

BR,
Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

asbjoern

Thanks a lot.
I have a 3.3v FTDI adapter similar to that one so I will give it a try.
I was not completely sure if the signals were reversed or the voltage level of DO.
I measured the DO pin and it was driven to 0v. UARTS rest at High level so I was not sure what kind of serial I was dealing with.
Since you got it working with this simple circuit I will give it a try.

I see you are from Denmark, as am I. Do you have one of the new meters delivered by Radius with encryption?
Mine is with encryption and i have the encryption key from Radius, but no authentication key. They might be the same. We will see how far I get.
Does it matter what I use as System title as long as it is 8bytes? And what is the dedicated key used for?

Thank you
Asbjørn

250266

Hi Asbjørn
I hope you will get your FTDI adapter working. I cannot see why it should not work. Just ask again if you have any problems.
My meter seems to be the same as yours but I do not have the encryption key from Radius. So I have not tried anything with encryption yet. If you dare to send me the key my email is npinvestor.dk (snabelA) gmail.com.
My next thing is to figure out what to do this the "custom OBIS code" stuff.

asbjoern

I got the ftdi working and got some communication going. I did get the same view as you but no values in the attribute 2 column and an error message.
The encryption keys are unique so my key will not work for you. To get yours you just need to give them a call on 70 26 40 60 and ask for it. I got mine within an hour. It is a 128bit hex string.
I tried requesting authentication key but they insisted it was not needed (sounded like I was the first to request it and they did not know what it was).
But I did get Kamstrups DLMS protocol description https://drive.google.com/file/d/1KjtE3qDOB87HHGe7FLwh_tnuN_ge0mdK/view?u...
It does not mention security at all.
I have tried enabling HighGMAC, General Protection, and put my key in as both cipher and authentication. I did not know what to put in System title so I just entered 8 random bytes of hex.
I just get "Failed to get reply from the device in given time"
You can find Kamstrups OBIS codes listed in this document:
https://norgesnett.no/wp-content/uploads/2019/01/Datablad-HAN-modul.pdf

Image: 
Kurumi
Kurumi's picture

Hi,

If you are not receiving data from the meter check your system title, block cipher key, and authentication key. Try to set frame counter (see pic). You can try to set it manually, or ask GXDLMSDirector to read it every time you make a connection. Set LN to or 0.2.43.1.1.255.

It's sad that Kamstrup is using custom OBIS codes. It causes that comparing data between the different meters is impossible.

BR,

Mikko

Image: 

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Kurumi
Kurumi's picture

Hi,

You can try to connect with low-level security. The default password is: 12345

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

asbjoern

Hi again
I tried connecting with low security and password 12345.
This gives me a ServiceError Initiate Error exception. initiate Other
Log: https://pastebin.com/n9xDtrqq

I still get the timeout error when I enable HighGMAC authentication. I notice the Client address changes when I change security Does this have any influence?
I do not know what to put into the system title, how should I obtain this value? My electricity company insisted that the encryption key should be enough to access the meter and referenced that this product only needs that key: https://www.smartred-shop.de/en/p/smart-me-kamstrup-modul-for-omnipower

Claus

Hi

I also have Radius / ONMIPOWER and I received my encryption key. However I have only been able to connect to the meter using C=16/S=1 and no password and no encryption. I that case I'm offered to download the object list which I can do successfully. I can also read related data - but the objects only contains a lot of static configuration data. The real meter data like 1.8.0 = active import kWh is not included. It seems that this data requires password / encryption key in some form. I think I covered most combinations of password/cipher/ClientID/ServerId but to no avail. Did anyone manage to get to the real meter data ? If yes I am VERY interested :-))

* GARFIELD is superior !

Kurumi
Kurumi's picture

Hi,

System title is 8-byte long value. Client app can usually use any value, but with some meters, it's defined. Client address changes when authentication level changes.

Try with those:
Authentication: Low
client address:18 (0x12)
Server address: 16 (0x10)
password: 12345
Conformance: GET, Block transfer with GET, SET, ACTION, SELECTIVE ACCESS

If you are using Optical interface, change client address to 19 (0x13) and if you are using CCC Module client address is 20 (0x14).

Use hex values in GXDLMSDirector.

BR,
Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Kurumi
Kurumi's picture

HI,

I just read other Kamstrup meter with those settings:

Authentication: Low
client address:18 (0x12)
Server address: 16 (0x10)
password: 12345
MaxInfoRX and MaxInfoTX: 512

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Claus

Thanks for the reply

I'm pretty sure I already tried that combination of C=19/S=16/Low/12345 but with MaxInfoRX/TX set to
1010 as recommended earlier and I got something like
Parsing AARE reply ServiceError Initiate Other
back which I assumed was the Low/12345 breaking the AA

* GARFIELD is superior !

Kurumi
Kurumi's picture

Hi,

Try also with settings:

Authentication: Low
client address:18 (0x12)
Server address: 16 (0x10)
password: 12345
MaxInfoRX and MaxInfoTX: 512

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Claus

Will do - when I get home tonight :-)

* GARFIELD is superior !

Claus

Fail - i tried to connect to both 0x12 and 0x14 (which should be the CCC where my com port is connected)

22:39:27 Initializing serial connection.
22:39:28 Send SNRM request.
7E A0 20 21 29 93 3E A1 81 80 14 05 02 02 00 06 02 02 00 07 04 00 00 00 01 08 04 00 00 00 01 6F EF 7E
22:39:28
7E A0 20 29 21 73 32 4E 81 80 14 05 02 02 00 06 02 02 00 07 04 00 00 00 01 08 04 00 00 00 01 6F EF 7E
22:39:28 Parsing UA reply succeeded.
22:39:28 Send AARQ request.
7E A0 41 21 29 10 F2 92 E6 E6 00 60 33 A1 09 06 07 60 85 74 05 08 01 01 8A 02 07 80 8B 07 60 85 74 05 08 02 01 AC 07 80 05 31 32 33 34 35 BE 10 04 0E 01 00 00 00 06 5F 1F 04 00 00 1E 1D FF FF 3E FE 7E
22:39:28
7E A0 2F 29 21 30 54 8C E6 E7 00 61 82 00 1F A1 09 06 07 60 85 74 05 08 01 01 A2 03 02 01 01 A3 05 A1 03 02 01 01 BE 06 04 04 0E 01 06 00 38 96 7E
22:39:28 Disconnect request
22:39:28
7E A0 07 29 21 73 40 96 7E
Gurux.DLMS.GXDLMSConfirmedServiceError: ServiceError Initiate Error exception. Initiate Other
at GXDLMSDirector.GXDLMSDevice.InitializeConnection()
at GXDLMSDirector.MainForm.Connect(Object sender, GXAsyncWork work, Object[] parameters)

* GARFIELD is superior !

Claus

Hi

I found that the system title is the _client_ system title and that you can specify server system title further down on the config page. I had mistaken the first system title for the server system title.

After that I managed to get a encrypted connect (no password). C=x14 S=x10 but when reading the objects collected unencrypted all the values were cleared as if the OBIS codes could no longer be accessed.

I tried to create a new device with same connection settings, but when it offers me to collect objects I get

Gurux.DLMS.GXDLMSException: ParseObjects failed. Invalid parameter.
at GXDLMSDirector.MainForm.RefreshDevice(GXDLMSMeter dev, Boolean bRefresh)
at GXDLMSDirector.MainForm.Refresh(Object sender, GXAsyncWork work, Object[] parameters)

I tried to add password low/12345 and use framemaxsizes of both 1010 and 512 - same error.

* GARFIELD is superior !

Kurumi
Kurumi's picture

Hi,

Did you try to connect without encryption (Security = None) and using HidhGMAC as authentication level?
Can you send encrypted trace? I can check if handshaking succeeded.

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Claus

If you can list the scenarios you want me to test - I can do it over the weekend.

Can I send you the results to some email instead of posting here ? Both for convenience and security...

* GARFIELD is superior !

Kurumi
Kurumi's picture

Hi Claus,

Send email to me. You can get my email address from here:
http://gurux.fi/AboutUs

I'm interested from uses cases:
1. Authentication level GMAC, no security.
2. Authentication level GMAC, Security Authenticated.
3. Authentication level GMAC, Security AuthenticatedEncrypted.

If you can connect and try to read and send log to me. I'll check the bytes on Monday.

BR,
Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Claus

Where do I find the interpretation/meaning of the AAResponse errorcodes ?
I see Result/ServiceUers = 02/01 01/01 01/0B
It would help me to understand if I'm poking in the right or wrong direction ?

* GARFIELD is superior !

asbjoern

Hi Claus
How exactly did you obtain the server system title and is that really needed for the encryption?
I have gotten a bit further and no longer get the timeout message after changing the server address to 0x10.
No matter what I try furthest I get is a log that translates to: <!--AUTHENTICATION_FAILURE-->
I'd love to know your exact configuration for actually getting an encrypted connect sequence.
Did you get a separate authentication key from Radius?
--Asbjørn

Claus

I'm working with Mikko OOB - I get back if I get it to work.
The Server system title I took from the SecuritySetup returned in public mode, but I'm not sure if it is correct.
I'm using same Radius key for both authentication and encryption.

* GARFIELD is superior !

asbjoern

Did you succeed getting signed into the meter?

Claus

Unfortunately, I have neither had any luck with my many hours of trying to guess the answer from various sources, nor have I got any useful information from Radius or Kamstrup. I'm still trying...

* GARFIELD is superior !

asbjoern

I am sorry to hear that.
Did you find confirmation for which client and server address it actually uses for the CCC module with HighGMAC?

asbjoern

I just got an email from Radius that said that the encryption key we got is not valid for DLMS/COSEM, only for Kamstrups proprietary and NDA protected KMP protocol.
They do not have the capability to hand out the encryption keys for DLMS/COSEM but they have asked Kamstrup to find a solution.
So I guess we will see what happens.

Claus

Funny thing is that I actually asked Radius, if they were absolutely sure that the handed out key was correct for DLMS :-)

* GARFIELD is superior !

Claus

Radius today communicated that Kamstrup are going to allow DLMS to consumers/endusers - however they need to firmware upgrade the meters before authentication and encryption keys can be handed over. This is expected to happen in June.

My best guess is that Kamstrup only implemented DLMS access with one security level - namely the need for the power supplier Radius. And hence they cannot hand out the keys to consumers. My guessing is that they will implement some differential access levels based on which port in the meter you use. That will allow Radius to have full access through the 4G wireless sealed inside the meter and consumers can have limited readonly access though the CCC and IR port.

I kind of assumed a multi level DLMS access based on different key sets but I'm not sure DLMS supports it. Maybe Mikko can comment on that.

* GARFIELD is superior !

250266

Thanks for continuing with this. I really hope there will be a solution so we can read the data.

Kurumi
Kurumi's picture

Hi,

I believe that there will be new client address and a new key that can be used for reading only.
Using different client address meter can decide what key to use and what functionality offered.

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

Claus

From what I have heard - the solution for Radius is likely to be similar to the Norwegian HAN solution. This means it will be a data pump solution where communication still will be encrypted DLMS. Only the CCC port will be supported and after establishing the DLMS connection, data will automatically flow towards the user - some data more frequent than other. The Norwegian HAN requires a special HAN HW module, however as I understand, the Radius solution will allow the user to communicate directly on the com port in the CCC module.

The Norwegian solution is described here (especially the data flow is interesting)
https://www.nek.no/wp-content/uploads/2018/10/Kamstrup-HAN-NVE-interface....

The solution is expected end of 2019 - but let's see :-)

* GARFIELD is superior !

Kurumi
Kurumi's picture

Hi Claus,

It's easy to receive push messages and encrypt them if you have correct keys. The only problem is that you need to know what data is sent on each push message.

It's a more secure solution when meter is sending push messages and client app can't make a connection.

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi

jgaarddk

Hi

What does OBIS codes look like?

Actual voltage phase L1 U-L1 32.7.0
Actual voltage phase L2 U-L2 52.7.0
Actual voltage phase L3 U-L3 72.7.0

https://byggebolig.no/imageoriginals/a92e2b86218347e3bd529f440661cd65.pdf?

Probably

Kurumi
Kurumi's picture

Hi,

I believe that the meter is sending a different kind of push messages. Content (OBIS codes) of push messages can be anything.

BR,

Mikko

________________________________________
Mikko Kurunsaari
Gurux Ltd
http://www.gurux.fi