ENERGY METRES
Prevent hacking, tampering in
energy metres
By Mohit Arora
Freescale Semiconductor
Today energy theft is a worldwide
problem that contributes heav-
ily to revenue losses. Consumers
have been found manipulating
their electric meters, causing
them to stop, under-register or
even bypassing the metre, ef-
fectively using power without
paying for it. This article discusses
vulnerabilities, challenges and
techniques to prevent tampering
in an energy metre.
Intro to energy meters
An energy metre is a device that
measures the amount of electri-
cal energy supplied to a residen-
tial or commercial building. The
most common unit of measure-
ment made by a metre is the kilo-
watt hour, which is equal to the
amount of energy used by a load
of one kilowatt in one hour.
Figure 1 shows a system block
diagram for a three-phase energy
metre. As shown the energy me-
tre hardware includes a power
supply, an analogue front end, a
microcontroller section, and an
interface section. The analogue
front end is the part that inter-
faces to the high voltage lines. It
converts high voltages and high
currents to voltages sufficiently
small to be measured directly by
the analogue/digital converter
(ADC) of the microcontroller.
Voltage measurement is done
with a shunt resistor (shown as
“Load”), while the current mea-
surements require more precise
measurement and thus are done
by current transformer (CT) on
all phases along with current
measurement on neutral. Meter
manufacturers often integrate
gain amplifiers in order to amplify
voltage as well as current mea-
surements in the range supported
by the ADC. The amount of ampli-
 eetindia.com | EE Times-India
fication required depends on the
ADC resolution as well as the Class
accuracy (0.1, 0.2. 1.0 etc.) required
for a three-phase metre.
A typical energy metre also
requires a real time clock (RTC)
for tariff information. The RTC re-
quired for a metering application
needs to be accurate (< 5ppm) for
Time of Day (TOD), which involves
dividing the day, month and year
into tariff slots. Higher rates are
applied at peak load periods and
lower tariff rates at off-peak load Figure 1: System block diagram for three phase energy metre.
periods.
The heart of the metre is the
firmware, which calculates active,
reactive energy based on voltage
and current measurement. The
firmware also includes tamper
detection algorithms, data log-
ging and protocols like DLMS and
Power Line Modem communica-
tion protocol for Automatic Meter
Reading (AMR).
The energy metre also needs
to be calibrated before it can be
used and that is done in a digital
domain for an electronic metre.
Digital calibration is fast, efficient
and can be automated, removing
the time-consuming manual trim-
ming required in traditional, elec- Figure 2: Normal phase neutral connection for single phase metre.
tromechanical meters. Calibration
coefficients are safely stored in an ing conditions and assure proper loads is connected to the ground
EEPROM that can be either inter- billing, unlike electromechanical and thus part of the return current
nal or external. meters. I2 does not go through the metre.
An energy pulse output (EP) This section describes several Thus the current in the neutral
is an indication of active power, tampering techniques used by wire IN, is less than that in the
as registered by the metre; the thieves along with solutions for Phase or live wire (IP).
frequency of the pulse is directly avoiding tampering. To detect this condition, firm-
proportional to active power. ware monitors the currents on
Partial earth fault condition both energy wires - Phase and
Hacking in energy metres An earth fault means some of the Neutral, and compares them. If
Due to the increasing cost of elec- load has been connected to an- they differ significantly, the firm-
tricity, energy theft is becoming a other ground potential and not ware uses the larger of the two
major concern for government the neutral wire. Figure 2 shows currents to determine the amount
agencies across the globe, and normal Phase and Neutral wire of energy to be billed and signals
especially in populous countries connections to the metre. Note a “fault” condition.
like India and China. that current going through the
A large portion of these rev- Phase wire is the same as coming Reverse current
enue losses can be recovered by out of the neutral wire (IP = IN). Reverse current occurs when the
installing electronic energy meters Figure 3 shows a partial earth phase and neutral are wired to
because they can detect tamper- fault condition where one of the the wrong inputs, causing cur-
rent to flow in the direction op-
posite to normal. Figure 4 shows
the same where the neutral wire
connection is swapped thus
causing current IN to flow in the
reverse direction.
Due to the reverse current
flow through Neutral, metering
firmware will show wrong signs
in active power readings. The
firmware activates the reversed
current indicator when any of the
two currents has a sign opposite
the one expected. To overcome
this, metering firmware always
uses the absolute value of active
power for driving the energy
pulse, thus reverse current has no
effect on energy calculation or ac-
curate billing.
Phase and neutral wire
swapped
Here live and neutral wires are
swapped, which makes the cur-
rent in the live wire less than that
in the neutral.
Missing neutral
A more common method of
tampering is shown in Figure
5. The missing neutral tamper-
ing condition occurs when the
neutral is disconnected from the
power metre. With the Neutral
disconnected, there is no voltage
input and thus no output would
be generated by the power sup-
ply. However when the load is
applied (Figure 5), there would
be a valid input signal on cur-
rent channel so power would be
consumed. Since the voltage on
neutral is zero, so is the power (P
= V x I).
To take care of this condition,
the tampering algorithm (part
of firmware) can assume volt-
age fixed at a known amplitude
and phase and continue power
calculation based on IRMS and
adjust the IRMS gain to produce
the same power output when the
voltage is at its nominal value. This
ensures billing is continued during
a missing neutral condition.
Most tampering algorithms
require current to be measured on
neutral apart from all the phases
to correctly detect a tamper event
and accurately calculate energy
 eetindia.com | EE Times-India
consumption.
Note: It is important to mea-
sure current on neutral in addition
to phase currents to detect any
mismatch in reverse current flow
during the described tamper con-
ditions so that metering firmware
can take appropriate steps for ac-
curate energy calculation.
Missing potential
Again this is a common connection
fraud usually deployed in meters
where the voltage component for
one of the phases is made zero by
removing one of the phase wires
from the metre terminal. This results Figure 3: Partial earth fault condition.
in recording less energy consump-
tion as consumption from one of
the phases becomes zero. (P = V x I
where V= 0)
During this condition since the
voltage is absent and current is
present, the logic is easily able to
sense this and record as tamper
event if condition persists for cer-
tain duration. Metering firmware
during this case can be tuned to
record maximum consumption.
Magnetic interference
Meters use magnetic material
in voltage and current measure-
ment circuits and thus are affected Figure 4: Reverse current condition.
by abnormal external magnetic in-
fluences, that in turn affect proper
functioning of the metre.
For example, the use of a
strong magnet to change the
magnitude of current—this in
turn introduces large errors in
measurement. The idea is to
saturate the core of the sensors
or distort the flux in the core so
that output is erroneous. This ef-
fectively results in less billing.
One way to avoid this is by hav-
ing magnet sensors to detect the
presence of abnormal magnetic
fields and provide evidence by
logging it as a tamper. Another
solution is to increase the gap
between the sensors and magnet, Figure 5: Missing neutral condition.
or by shielding the sensors and
thus suppressing the effect of the not wound around a metallic core. to gain increasing acceptance and
magnetic field. Since there is no core to saturate in desirability in anti-tamper meter-
A cleaner solution is to use a the presence of strong magnetic ing applications.
Rogowski Coil instead of a conven- fields, these sensors are largely im-
tional current transfer for current mune to magnetic tampering. Neutral disturbance
measurement. Rogowski coils are The Rogowski coil is beginning This is similar to Section 2.4 ex-
cept that apart from tampering
with the neutral at the source,
high-frequency signals are su-
perimposed on neutral causing
inaccurate current measurement
and thus reducing the energy
recorded by the metre.
Under this condition, metering
firmware may choose to calcu-
late energy based on maximum
current and record the event as
Tamper.
Other board design techniques
like using ferrite beads, capacitor
line filters and physically large SMD
resistors help to protect the metre
electronics from various forms of
electromagnetic disturbance.
Powering off metre
Meter can be powered off by
removing all the voltage connec-
tions.
Bypassing metre
There are many ways to bypass
an energy meter metre. The
most common way is by put-
ting a jumper (Figure 6) in metre
terminal such that connection is
bypassed and the energy con-
sumption is not registered. This
kind of meter metre bypass can
be easily detected. Another type
of metre bypass is by removing
the external potential copper on
the terminal. These events can
be compared with power failure
records from the substation data.
The event date and time logging
is enough to identify these ab-
normal power failures and their
duration.
Double feeding the metre
Figure 7 shows another yet tech-
nique—”Double Feeding” to by-
pass the metre where additional
feeding is connected directly to
the line so that the consump-
tion for additional feeding is not
registered.
Here one would have legal ser-
vice but the metre will not register
the consumption for bypass load.
Usually the additional feeding is
done to connect an appliance
that requires more electricity load
(like the air conditioner shown in
the Figure 7). The other loads like
 eetindia.com | EE Times-India
lights, still go through legal con-
nection so that the electric com-
pany will not get suspicious.
Meter bypass by double feed-
ing is one of the easiest conditions
to detect unless the cables around
the metre are so dense that it is
difficult to notice which ones are
legal and which are not.
Meter manipulated
Unlike electromechanical meters
where techniques like manipu-
lating the disc brakes or slowing
them so that the metre records
less consumption are used, these
techniques cannot be used on an
electronic metre. Figure 6: Meter bypass with jumpers.
Metres (generally electro-
mechanical) with counter type
display are generally based on a
stepper motor for disc rotation
and are prone to errors as they can
be easily manipulated to alter the
metre reading.
These problems are overcome
by providing an electronic display
(like an LCD) in the meters that
are now common in electronic
meters.
External tampers
External tampering may include
breaking the metre case, chemi-
cal injection or even burning the
metre. All these result in chang-
ing the electrical characteristics
of the components thereby re-
cording less or no energy usage.
Figure 7: Double feeding to bypass metre.
One may want to open the metre
case to change the settings or
even remove the backup battery voltage/frequency generating e.g., changing PM to AM such that
so that the metre will reset when device. It is recommended to fol- metering firmware charges less
the main power goes off. low some of the board guidelines due to non-peak load during that
Anti-tamper switches can be mentioned in Section 2.7 along time. Thus, the RTC circuit should
placed on the casing of the metre with high-tolerant IOs to avoid not allow time reversal unless it
to trigger a tamper when the cas- any influence of a 35-kV spike on follows a secure protocol.
ing is opened. energy calculation. Other techniques include
changing the RTC crystal as the
High voltage/frequency Changing the time RTC usually relies on a 32.768-kHz
tamper Electric companies may have external crystal oscillator. The RTC
A metre can be tampered with different billing rates depending circuit should be able to detect
by an electrostatic device that on time of the day, maximum this and correct the time. Thus,
generates spikes or voltages demand, load, etc., thus making on-chip compensation should be
in the range of 35 kV. This may a real time clock (RTC) an essen- an essential feature for an energy
induce errors in consumption tial part of the electronic metre metre.
recording or may even damage to provide time reference. One Crystal characteristics vary
the metre. The accuracy of the may tamper with the clock or widely with temperature. Thus,
metre should not be affected manipulate the time to fool the temperature changes can pro-
by the application of abnormal system and charge differently, duce an inaccurate reference.
The RTC circuit should be able to
detect changes in temperature
and compensate for them by
adding or removing clock pulses.
The clock accuracy desired for any
metering applications needs to be
less than 5 PPM.
Note: It is important that the
RTC for any metering application
must support standby operation
when the RTC keeps working (on
battery) even during power failure
thereby retaining the time.
Techniques for tampering pre-
vention
Automatic metre reading
(AMR)
Automatic metre reading (AMR)
technology refers to the capabil-
ity of the metre to communicate
its reading to a fully automated
collection and communication
centre, via the use of wired or
wireless networking infrastruc-
ture. Some of the AMR technolo-
gies employed in various regions
 eetindia.com | EE Times-India
around the world include: Radio
frequency (RF), ZigBee proto-
col, data modem (via standard
telephone network) and power
line communication (PLC). Other
partial communication may in-
clude reading via optical port in
an “electronic reader” device. The
later may be based on Serial Port
(RS-485) or Infrared Link.
With AMR, any tampering
events logged in the memory
can be provided to the substation
via AMR network if there are any
discrepancies between the total
billed and the total generated
power.
Code protection
One of the advantages of AMR is
remote firmware upgrade. It is im-
portant to authenticate firmware
patches and reject unauthorised
or tampered software. Though
security is built into some of the
protocols like ZigBee (ECC public
key technology) when used for
AMR communications, it is worth
considering that any code protec-
tion schemes used should pro-
vide additional security. Sensitive
keys may be stored in hardware
with policies and procedures for
enrolling and authorising system
along with using data encryption
schemes.
Tampering seals
It is always best to prevent a
problem rather than fix it after it
has occurred. Nowadays there are
specially designed seals available
for use on electric and utility me-
ters. These seals should be used
on metres during installation to
prevent unauthorised access. It
is recommended that electronic
meters should be provided with
front side seals so that they are
readily visible to a metre reader
or inspector.
There are several companies
that offer seals especially designed
for energy meters such that a seal
once broken cannot be glued or
reapplied on the metre. Many me-
ters also have external cases that
prevent opening without damag-
ing the metre.
Conclusion
To control revenue losses, util-
ity companies worldwide need
to detect metre tampering and
ensure accurate billing even
when tampering has occurred.
Tampering may range from sim-
ple techniques like manipulat-
ing live or neutral wires to more
sophisticated ones like hacking
firmware and changing energy
consumption records.
Energy metering ASICs are
available that provide solutions for
implementing multiple layers of
tamper detection implemented
as a part of hardware and software
solution.