Stealth naked
Posted: Sun Sep 06, 2015 2:32 pm
Hi guys
Plugwise has made it to Oz, and I dipped my toe because of the coordination announcement with SMA, allowing SMA Home Manager to control PlugWise sockets with the next software release (I hope).
If you are not aware, Home Manager can link to a 3-phase high current measurement device at grid entry, do the math according to inverter output from solar, and show a real-time usage balance, amongst other things. I have a Stretch, a few Stings, and a few Stealths – the Stealths aren’t in yet.
At this stage I have attempted to bring myself up-to-date on the community, and it certainly appears that a number of talented programmers have been looking at opening up the protocols for inspection and adoption into other systems. I haven’t found much investigation of the hardware.
I’m interested in two things:
• A PlugWise-friendly ZigBee repeater with a little more grunt;
• A Stealth variant with 32A measurement and switch capacity.
The former is to get past the meshing problems in a long building without overkill on units (let’s face it, knowing the current draw of the LED desk light at any one time is not on my priority list). The latter is to make sure I cover the big-ticket power items so that I can load-shed when I have a solar energy deficit. However, a 16A limit does not cover dedicated line devices (Pool Pumps, Spas, Some Air Cons et cetera) and knowing consumption is potentially a big deal.
Plugwise Stealth hardware Open the box (not that I would do that, of course; instead I employed my X-Ray camera), and you would find a small PCB with a smaller daughterboard. This could be a 14-pin standard PICtail interface design in which case RC0 is expected to be the default output to timer1 clock through an opto-isolator (speculation on my part – it’s a custom daughterboard).
Daughterboard The main chip (Ember EM250) is a now-outdated ZigBee SOC. It has a 12MHz 16-bit processor core, 128k Flash, 5k RAM and a 128 AES engine in addition to the transceiver. Immediately adjacent is a 4 Meg serial firmware flash memory.
Main Board The metering function is all on-chip, contained within a MCP3905A metering IC. This little bunny will measures ingle-phase active (real) power at 0.1% error and employs the IEC standard with very low shunt resistance (<200 microOhms) providing a proportional frequency output. The shunt appears to be a 1 millliOhm (0.001 Ohm) PMR25 resistor (marked 1L0 between live in and live out). These are rated as 1W.
The mains relay is a high-dielectric (5kV) 5V miniature relay with single pole single throw 16A connectors.
Thoughts
So – the relay contacts are obviously a vulnerable area, but if they were replaced or bridged, what is the maximum current that can a) be put through the shunt and b) be measured and transmitted safely? The shunt will be dissipating 1W at 37A AC RMS, so putting more than 30A through is obviously getting to be a concern (about 0.03V drop). Spec says 16A; I wonder if there is headroom in the frequency and/or parameter transfer for a higher current if the shunt will take it.
The 3905 reference design is specified for 10A with a 40A limit, using a shunt resistor of 250 microOhms (one quarter of the Plugwise implementation). If the current design doesn’t have a headroom for 32A measurement, one possibility (albeit a workaround) is a new shunt, an upgraded relay, a new device type in firmware, and use of a multiplier in the calculation software. I would be interested if anyone has got into the guts, as it were.
Plugwise has made it to Oz, and I dipped my toe because of the coordination announcement with SMA, allowing SMA Home Manager to control PlugWise sockets with the next software release (I hope).
If you are not aware, Home Manager can link to a 3-phase high current measurement device at grid entry, do the math according to inverter output from solar, and show a real-time usage balance, amongst other things. I have a Stretch, a few Stings, and a few Stealths – the Stealths aren’t in yet.
At this stage I have attempted to bring myself up-to-date on the community, and it certainly appears that a number of talented programmers have been looking at opening up the protocols for inspection and adoption into other systems. I haven’t found much investigation of the hardware.
I’m interested in two things:
• A PlugWise-friendly ZigBee repeater with a little more grunt;
• A Stealth variant with 32A measurement and switch capacity.
The former is to get past the meshing problems in a long building without overkill on units (let’s face it, knowing the current draw of the LED desk light at any one time is not on my priority list). The latter is to make sure I cover the big-ticket power items so that I can load-shed when I have a solar energy deficit. However, a 16A limit does not cover dedicated line devices (Pool Pumps, Spas, Some Air Cons et cetera) and knowing consumption is potentially a big deal.
Plugwise Stealth hardware Open the box (not that I would do that, of course; instead I employed my X-Ray camera), and you would find a small PCB with a smaller daughterboard. This could be a 14-pin standard PICtail interface design in which case RC0 is expected to be the default output to timer1 clock through an opto-isolator (speculation on my part – it’s a custom daughterboard).
Daughterboard The main chip (Ember EM250) is a now-outdated ZigBee SOC. It has a 12MHz 16-bit processor core, 128k Flash, 5k RAM and a 128 AES engine in addition to the transceiver. Immediately adjacent is a 4 Meg serial firmware flash memory.
Main Board The metering function is all on-chip, contained within a MCP3905A metering IC. This little bunny will measures ingle-phase active (real) power at 0.1% error and employs the IEC standard with very low shunt resistance (<200 microOhms) providing a proportional frequency output. The shunt appears to be a 1 millliOhm (0.001 Ohm) PMR25 resistor (marked 1L0 between live in and live out). These are rated as 1W.
The mains relay is a high-dielectric (5kV) 5V miniature relay with single pole single throw 16A connectors.
Thoughts
So – the relay contacts are obviously a vulnerable area, but if they were replaced or bridged, what is the maximum current that can a) be put through the shunt and b) be measured and transmitted safely? The shunt will be dissipating 1W at 37A AC RMS, so putting more than 30A through is obviously getting to be a concern (about 0.03V drop). Spec says 16A; I wonder if there is headroom in the frequency and/or parameter transfer for a higher current if the shunt will take it.
The 3905 reference design is specified for 10A with a 40A limit, using a shunt resistor of 250 microOhms (one quarter of the Plugwise implementation). If the current design doesn’t have a headroom for 32A measurement, one possibility (albeit a workaround) is a new shunt, an upgraded relay, a new device type in firmware, and use of a multiplier in the calculation software. I would be interested if anyone has got into the guts, as it were.