wM-Bus radio water meters: reading them with a Raspberry Pi and a CC1101

What the meter sends

A water meter with a radio module (e.g. Apator AT-WMBUS-16-2) sends a telegram in T1 mode on 868.95 MHz every few dozen seconds up to every quarter of an hour. It carries the meter number, manufacturer, medium, meter reading and sometimes flow, temperature and alarms. The payload is usually AES-128 encrypted.

Hardware

The CC1101 is a cheap sub-GHz radio chip controlled over SPI. Wiring to a Raspberry Pi:

The GDO0/GDO2 lines are not needed if the program polls the chip's FIFO over SPI roughly every millisecond. Fewer wires mean fewer wiring mistakes – our first prototype stopped working precisely because the GDO lines were on different pins than the code expected.

From bits to cubic metres

1. "3 out of 6" encoding (T1 mode) and a CRC on every block – noise gets rejected.
2. Link layer: manufacturer (three letters), number, version, device type.
3. AES-128-CBC (mode 5) – the key comes from the meter supplier; some meters use a factory key.
4. DIF/VIF records (OMS standard): reading, billing-date reading, flow… Some manufacturers (e.g. Apator 16-2) add their own format after the 0x0F byte.

Lessons from deployment

• Receiver in a separate process. FIFO reads have to keep up. In Python, where everything shares one GIL, a network scan dropped telegrams, so the radio got its own process.
• You hear the neighbours too. In 4 minutes the gateway received 32 telegrams from 10 meters nearby. A meter is assigned by its number; the rest is ignored.
• Statistics, not just RSSI. Counts of OK / CRC error / timeout over the last minute show reception quality better.
• No guessing. No telegram for 2 hours means the meter is inactive, not "last known value".
• Tests on real telegrams: the FIPS-197 AES vector and frames recorded from live meters.