Following on from the recent teardown of a cheap energy meter, I thought there might be some potential to hack this device. Well the EOUT “pulse output” pin shows some promise. The chip’s datasheet says that the EOUT pin outputs a pulse for each unit of energy the meter measures. Additionally, this function is enabled by default.
Since this is enabled, by default, I made some mods to the case and soldered 3x wires directly to the chip.
The obligatory warnings prevail. Do not:
- Attempt or copy any of this if you do not fully understand or appreciate the hazards of mains power
- Open the meter whilst connected to mains power
- Perform any measurements whilst the meter’s case is open
- Connect another mains powered device to measure the chip. The energy meter’s power supply is not isolated from active, neutral or earth.
The connections that were made to the chip are:
- 5V – soldered directly to a decoupling capacitor
- Digital GND – soldered directly to a decoupling capacitor
- EOUT – Pin 21
Once the whole device was reassembled and using a CAT3 rated multimeter and test clips, the energy meter was powered up. Between the 5V and digital GND connections, 5.03 volts were measured – great start.
Next the voltage between digital GND and EOUT were measured for different appliance loads:
| Appliance | Appliance Wattage | EOUT to GND Voltage |
|---|---|---|
| No appliance connected | 0W | 5.03V |
| Bar heater 50% elements on | 500W | 5.00V |
| Bar heater 100% elements on | 1000W | 4.97V |
| Clothes iron | 2200 – 2400W | 4.9V |
These results were repeatable and the measured voltages were steady and the results suggest that the EOUT pin is outputting pulses.
The datasheet says that the EOUT pin is active low and pulses when a “unit of energy” is measured. The results appear to corroborate with the datasheet’s description of the EOUT pin. That is, the higher wattage loads will draw more energy and there will be more active-low pulses. As the number of EOUT pulses increases, there will be a reduction in the average voltage across the EOUT pin – think duty cycle.The multimeter measures its voltage slowly and averages its input, the more EOUT pulses, the lower the voltage measured.
A better method of confirming and measuring the EOUT pulses will be with a logic analyser. However, the EOUT pin is not isolated relative to the mains neutral and it would be very foolish to connect another mains powered instrument to the EOUT pin. A solution is to use some opto-isolators to provide a separation between the voltages. At the moment I don’t have any optos, so this hack up will have to wait for another day.
SteelCity Electronics 
One thought on “Energy Meter Hacking”