Very Cheap TED 1001 House Power Monitors (and possible hacking)
- Thread starter naething
- Start date
roussell
Active Member
BLH said:
You might be on to something - the inversion holds true for the 2nd byte also. I get a constant 0xDF which when flipped becomes 0x20 which is a decimal 32. 32 is in fact my MTU's housecode. I'll see if flipping everything else works and report back. Thanks for the pointer!
Terry
BLH said:
Automate said:
roussell said:
For those that received the TED 5000 MTU, would you please post a link from whom you purchased it from? I'm assuming from your posts that you ordered the 1001 and received the 5000 version. I'd like to get one myself, but would prefer the 5000 version.
No I got a TED 1001 with a TED5000 MTU. All the photos on Ebay showed the TED1001 and what looks like the TED5000 MTU with wiring harnesses.
I have no data on if it was customized for use with a TED1001. As the addendum to install it. Said cap off and don't use the Red wire from the MTU. Just the Black to one breaker and White to Neutral.
Looking at the photos of the MTU for the TED1001 and the TED5000. The MTU's ID number is in a different format between the two versions.
I found an interesting thing. I had an older revision TED5000 Installation Manual and it shows the Red wire of the MTU connected to a breaker on the opposite phase as the Black wire is connected to.
I just downloaded the latest TED5000 Installation Manual and it also shows the Red wire capped off with the supplied red sleeve. Not connected to any breakers. It indicated that the signal strength of the power line signal is higher with the Red wire capped off.
I have no data on if it was customized for use with a TED1001. As the addendum to install it. Said cap off and don't use the Red wire from the MTU. Just the Black to one breaker and White to Neutral.
Looking at the photos of the MTU for the TED1001 and the TED5000. The MTU's ID number is in a different format between the two versions.
I found an interesting thing. I had an older revision TED5000 Installation Manual and it shows the Red wire of the MTU connected to a breaker on the opposite phase as the Black wire is connected to.
I just downloaded the latest TED5000 Installation Manual and it also shows the Red wire capped off with the supplied red sleeve. Not connected to any breakers. It indicated that the signal strength of the power line signal is higher with the Red wire capped off.
pete_c
Guru
Hooked up the TED1001 tonight. Playing with the the following script:
#!/usr/bin/perl
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
$cnt = 0;
$started = 0;
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
sub processPacket() {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
$power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
Getting this:
and this:
Main:
rocessPacket() called too early to check prototype at ./ted.pl line 26.
Name "main::cnt" used only once: possible typo at ./ted.pl line 10.
0x55 0x0C 0xD5 0xF6 0x99 0x02 0x09 0xEF 0x6A 0xFB 0xD7 11/21/2013 0:52:30,2.74235294117647,122.447058823529
#!/usr/bin/perl
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
$cnt = 0;
$started = 0;
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
sub processPacket() {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
$power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
Getting this:
and this:
Main:
rocessPacket() called too early to check prototype at ./ted.pl line 26.Name "main::cnt" used only once: possible typo at ./ted.pl line 10.
0x55 0x0C 0xD5 0xF6 0x99 0x02 0x09 0xEF 0x6A 0xFB 0xD7 11/21/2013 0:52:30,2.74235294117647,122.447058823529
linuxha
Active Member
pete_c said:Hooked up the TED1001 tonight. Playing with the the following script:
and this:
Main:
Name "main::cnt" used only once: possible typo at ./ted.pl line 10.
0x55 0x0C 0xD5 0xF6 0x99 0x02 0x09 0xEF 0x6A 0xFB 0xD7 11/21/2013 0:52:30,2.74235294117647,122.447058823529
Not sure i this is what you are asking for.
Short answer, remove cnt and move the sub processPacket() to the top of the file.
For a better description see http://www.perlmonks.org/?node_id=162876.
longer answer:
- remove or comment out the $cnt = 0; line
- add sub processPacket($); near the top of the file
- add a $ to the lower sub processPacket() { ( sub processPacket() { becomes sub processPacket($) { )
linuxha
Active Member
pete_c said:Hooked up the TED1001 tonight. Playing with the the following script:
#!/usr/bin/perl
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
$cnt = 0;
$started = 0;
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
sub processPacket() {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
$power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
Getting this:
and this:
Main:
Name "main::cnt" used only once: possible typo at ./ted.pl line 10.
0x55 0x0C 0xD5 0xF6 0x99 0x02 0x09 0xEF 0x6A 0xFB 0xD7 11/21/2013 0:52:30,2.74235294117647,122.447058823529
Not sure i this is what you are asking for.
Short answer, remove cnt and move the sub processPacket() to the top of the file.
For a better description see http://www.perlmonks.org/?node_id=162876.
longer answer:
- remove or comment out the $cnt = 0; line
- add sub processPacket($); near the top of the file
- add a $ to the lower sub processPacket() { ( sub processPacket() { becomes sub processPacket($) { )
pete_c
Guru
Thank-you LinuxHA. Sort of works. Still seeing one issue.
#!/usr/bin/perl -w -s
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
# $cnt = 0;
$started = 0;
sub processPacket($);
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
# sub processPacket() { ( sub processPacket() { becomes sub processPacket($}
sub processPacket() {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
# $power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
close INFILE;
Its the syntax I used here: (which I know is wrong).
# sub processPacket() { ( sub processPacket() { becomes sub processPacket($}
#!/usr/bin/perl -w -s
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
# $cnt = 0;
$started = 0;
sub processPacket($);
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
# sub processPacket() { ( sub processPacket() { becomes sub processPacket($}
sub processPacket() {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
# $power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
close INFILE;
root@ICS-ZM2:/usr/bin# ./ted.pl
Unquoted string "becomes" may clash with future reserved word at ./ted.pl line 35.
syntax error at ./ted.pl line 35, near "( sub processPacket() "
Prototype not terminated at ./ted.pl line 35.
root@ICS-ZM2:/usr/bin# ./ted.pl
Prototype mismatch: sub main:
0x55 0x0C 0xF3 0x54 0x02 0x03 0xCA 0x5C 0x69 0xFC 0xC4 11/21/2013 8:25:14,3.17470588235294,120.550588235294
0x55 0x0C 0xF4 0xC8 0x03 0x03 0x23 0x73 0x69 0xFC 0xDE 11/21/2013 8:25:15,3.17882352941176,120.658823529412
0x55 0x0C 0xF5 0xD0 0x02 0x03 0x23 0x73 0x69 0xFC 0xD6 11/21/2013 8:25:16,3.17470588235294,120.658823529412
0x55 0x0C 0xF6 0x36 0x06 0x03 0x23 0x73 0x69 0xFD 0x6B 11/21/2013 8:25:17,3.19117647058824,120.658823529412
0x55 0x0C 0xF7 0xDE 0x00 0x03 0x23 0x73 0x69 0xFC 0xC8 11/21/2013 8:25:18,3.16647058823529,120.658823529412
0x00 0x55 0x0C 0xF8 0x4C 0x03 0x03 0x23 0x73 0x69 0xFD 0x56 0x55 0x0C 0xF9 0x4C 0x03 0x03 0x23 0x73 0x69 0xFD 0x55 ^C
root@ICS-ZM2:/usr/bin# ./ted.pl
Unquoted string "becomes" may clash with future reserved word at ./ted.pl line 35.
syntax error at ./ted.pl line 35, near "( sub processPacket() "
Prototype not terminated at ./ted.pl line 35.
root@ICS-ZM2:/usr/bin# ./ted.pl - this is working except for the Prototype mismatch piece which is the line mentioned below.
Prototype mismatch: sub main:
0x55 0x0C 0x54 0x5A 0x01 0x03 0x23 0x73 0x69 0xFD 0xEE 11/21/2013 8:26:51,3.17058823529412,120.658823529412
0x55 0x0C 0x55 0xB8 0x05 0x03 0xCA 0x5C 0x69 0xFC 0xFB 11/21/2013 8:26:52,3.18705882352941,120.550588235294
0x55 0x0C 0x56 0xB2 0x06 0x03 0x71 0x46 0x69 0xFD 0x6E 11/21/2013 8:26:53,3.19117647058824,120.447058823529
0x55 0x0C 0x57 0xB8 0x05 0x03 0x71 0x46 0x69 0xFD 0x68 11/21/2013 8:26:54,3.18705882352941,120.447058823529
0x55 0x0C 0x58 0x18 0x0A 0x03 0x71 0x46 0x69 0xFE 0x02 11/21/2013 8:26:55,3.20764705882353,120.447058823529
0x55 0x0C 0x59 0xD0 0x02 0x03 0x71 0x46 0x69 0xFD 0x51 11/21/2013 8:26:56,3.17470588235294,120.447058823529
0x55 0x0C 0x5A 0xB8 0x05 0x03 0x71 0x46 0x69 0xFD 0x65 11/21/2013 8:26:57,3.18705882352941,120.447058823529
0x55 0x0C 0x5B 0x5A 0x01 0x03 0xCA 0x5C 0x69 0xFD 0x57 11/21/2013 8:26:58,3.17058823529412,120.550588235294
0x55 0x0C 0x5C 0x4C 0x03 0x03 0xCA 0x5C 0x69 0xFD 0x62 11/21/2013 8:26:59,3.17882352941176,120.550588235294
0x55 0x0C 0x5D 0x5A 0x01 0x03 0xCA 0x5C 0x69 0xFD 0x55 11/21/2013 8:27:0,3.17058823529412,120.550588235294
0x55 0x0C 0x5E 0xD6 0x01 0x03 0xCA 0x5C 0x69 0xFC 0xD8 11/21/2013 8:27:1,3.17058823529412,120.550588235294
^C
Its the syntax I used here: (which I know is wrong).
# sub processPacket() { ( sub processPacket() { becomes sub processPacket($}
pete_c
Guru
Fixed. Works great! Thank you LinuxHA.
#!/usr/bin/perl -w -s
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
# $cnt = 0;
$started = 0;
sub processPacket($);
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
# Working sub process packet stuff
sub processPacket($) {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
# $power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
#!/usr/bin/perl -w -s
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
# $cnt = 0;
$started = 0;
sub processPacket($);
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$a = 0;
}
}
}
# Working sub process packet stuff
sub processPacket($) {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
# $power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
Well it worked a couple of times...something is throwing the script off now...
linuxha
Active Member
Yup, but I haven't a clue as to what yet. It's not obvious. We see the hex print, which is followed by a $a++. There are more than 11 bytes there so that doesn't make sense.pete_c said:
You might consider adding
$started = 1;
after
if ($sum == 0) { processPacket($data); }
I don't think that will mess up the logic and it might help with a resync (though you could lose some 'packets' until it sync's back up).
pete_c
Guru
Thank-you Neil!
Looks to be good now. I let it run a while (well just a few seconds).
#!/usr/bin/perl -w -s
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
# $cnt = 0;
$started = 0;
sub processPacket($);
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$started=1;
$a = 0;
}
}
}
# Working sub process packet stuff
sub processPacket($) {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
# $power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
Will let it run a bit (minutes/hours?).
Looks to be long and short values maybe?
Probably would work better rounding off the number to 2 decimal places. Same probably for the voltage readings.
Looks to be good now. I let it run a while (well just a few seconds).
#!/usr/bin/perl -w -s
system("stty -F /dev/ttyUSB0 1200 cs8 raw");
open INFILE, "/dev/ttyUSB0"
or die "\nCannot open /dev/ttyUSB0!\n";
@data = ();
$buf = "";
# $cnt = 0;
$started = 0;
sub processPacket($);
while (read(INFILE, $buf, 1)) {
$d = ord($buf) ^ 0xff;
if ($d == 0x55 && $started == 0) {
$started = 1;
$a = 0;
}
if ($started == 1) {
$data[$a] = $d;
$sum += $data[$a];
printf("0x%02X ", $data[$a]);
$a++;
if ($a >= 11) {
$sum -= $data[9];
$sum &= 0xff;
if ($sum == 0) { processPacket($data); }
$started=1;
$a = 0;
}
}
}
# Working sub process packet stuff
sub processPacket($) {
local($data) = @_;
# If the power reading is way off, uncomment the other power line
# $power = (($data[5]^0xff)<<8) + ($data[4]^0xff);
$power = ($data[5]<<8) + $data[4];
$voltage = ($data[8] << 8) | $data[7];
$voltage = 123.6 + ($voltage - 27620) / 85 * 0.4;
$power = 1.19 + 0.84 * (($power - 288.0) / 204.0);
@tda = localtime(time);
$td = ($tda[4]+1)."/$tda[3]/".(1900+$tda[5])." $tda[2]:$tda[1]:$tda[0]";
print "$td,$power,$voltage\n";
}
close INFILE;
Will let it run a bit (minutes/hours?).
Looks to be long and short values maybe?
Probably would work better rounding off the number to 2 decimal places. Same probably for the voltage readings.
