Kill-A-Watt wireless protocol

Hello, all!

I haven't posted here lately because a couple of years ago I decided to go walkabout for a bit and all my projects and instruments have been in storage. Being in one place again, I am renewing my interest in measurement and control and am currently most interested in energy usage in the abode and supplementing some of the grid power with solar.

After having used the wired Kill-A-Watt power monitor for a while and being impressed with its accuracy I decided to try out the Wireless version. In my experience it is just as accurate as the wired version and is packaged nicely. The only problem for me is the manufacturers, P3 International, haven't chosen to provide a computer interface to the data available in the readout.

I haven't unpacked an oscilloscope and logic analyzer yet so everything I know about the wireless Kill-A-Watt display is just from looking around inside one and guessing from experience. The radio is a 915 MHz ISM band unit but unfortunately is a bonded chip variety that makes figuring out what the signals going in and out are, difficult. There is also a SOC that is a surface mount part and I'm hoping that the demodulated signal from the radio can be intercepted on the way to that. If so, it will be relatively simple to grab the sensor data off that and send it to the Arduino for further processing/communication.

So, that's my project. Any thoughts on feasability etc. are welcome.

Hello EmilyJane!

What is on the other side? Does P3 also sell a receiver? With PC software? Or a dedicated receiver and display?

Hi!

Yes, the receiver/display runs off 3 AA cells and is very nice except for the fact that there is no computer interface.

I finally found my magnifier. The receiver has a radio chip that is bonded to the PCB and covered with black epoxy. Not very helpful. There is a 28.30625 MHz oscillator crystal and what looks like a resonator marked 10.7. It might be a SOC with radio and controller hence the two frequency determiners. A 915 MHz TI SOC I've worked with uses crystals in that range.

The display controller was on the other side of the PCB. When you lift the PCB, you find that it connects to the LCD through a pair of those conductive polymer strips that are common for that. The controller is an Elan EM78P510 8-bit micro controller with 8K ROM and 128 bytes of RAM. I'm on the manufacturer's site but so far none of the links have produced a data sheet. There is the obligatory 24C02 EEPROM as well.

If I can find a data sheet, It'll be easier to find the data in from the radio. Otherwise, I'll have to get some tools out of storage. Need to do that anyway.

Anyone with any ideas, dive in! :-D

Hey Emily:

Have you made any progress on this project. I'm interested. So far, all I've been able to figure out is that it uses a 916.5 mhz radio in the US.

Thanks!

Hey! I shorted out my spare receiver while probing around and haven't had the nerve to poke into my remaining one. I've been busy traveling around the country and haven't done much with Arduino lately. I'm certainly interested to see anything you come up with.

Hey EmilyJane:

Ok. I finally got something to work. Basically, I picked up the PowerCost WiFi Gateway and connected it to my power meter. This device connects the PowerCost meter to the internet. I discovered that it puts out a UDP message every 30 seconds or so that contains the meter watt hours, current watthour usage, temp, signal strength, and a low battery indicator. It works great and gives me pretty much everything I need.

Email me directly if you have any questions.

Thanks!
Mike B.
Riverview, FL

Hi EmilyJane,

I am interested in monitoring my home appliance electricity usage. I'm annoyed that 1) the base station only supports up to 8 sensors and 2) that they don't talk on a standard wireless network.

I have emailed the company asking if the above is possible and suggested it as a product. Many people have wireless home networks these days and it seems only logical to me to sell a device that would communicate over a standard home wireless network.

I found this spec sheet on the device:

http://www.menards.com/main/store/20090519001/items/media/Electrical/P3International/Prod_Tech_Spec/P4200specsheet.pdf

It says that the radio broadcasts at 916.5 Mhz.

How does one "scan" or otherwise "hack" such things? I have little experience with electronics, but I am curious enough to try and start hacking. I have a BS in Computer Science.

I would imagine you tune a radio of some kind to 916.5 Mhz and listen, hopefully the signal is not encrypted but is ASCII text in binary format?

What do you use to listen to the signal and pick it apart? Does the oscilloscope actually record a line like a "heartbeat" with the spikes representing ones?