ESP8266/ESP32 decrypts wireless MBus frames from a Multical21 water meter.

The hardware you need:

• ESP8266 or ESP32 - i took an ESP8266 D1 mini clone.
• CC1101 module for 868 MHz
• some wires

The CC1101 868 MHz module is connected via SPI to the ESP8266/ESP32.

The best approach to build this software is using PlatformIO. If you are not familiar with PlatformIO, here is a good place to start.

The Multical21 is transmitting encrypted MBus frames (Mode C1, frame type B) every 16 seconds. The ESP8266/ESP32 does some validation (correct serial number, crc checking) and then decrypts them with AES-128-CTR.

The Multical21 provides the following meter values:

• total counter - total water consumption in m³
• target counter - water consumption until 1. day of the current month
• medium temperature - in °C
• ambient temperature - in °C
• info codes - BURST, LEAK, DRY, REVERSE, TAMPER, RADIO OFF

The ESP8266/ESP32 prints out the current meter values via UART (baudrate: 115200). The UART output looks something like this:

total: 1636.265 m³ - target: 1624.252 m³ - 13 °C - 22 °C - 0x00

Additionally the meter values are sent via MQTT to a given broker.

Rename config_template.h to config.h and fill in some information.

The serial number (8 digits) is printed on the water meter (above the LCD). Ask your water supplier for the decryption key (16 bytes). I got mine packed in a so called KEM-file. To extract the key i used a python script kem-decryptor.py

Provide your water meter serial number and decryption key in config.h:

// ask your water supplier for your personal encryption key 
#define ENCRYPTION_KEY      0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF
// serial number is printed on your multical21
#define SERIAL_NUMBER       0x63, 0x00, 0x05, 0x43

Provide your wifi credentials (ssid, password). Add your optional MQTT broker ip address. If your broker uses authentication add MQTT username/password.

// "ssid", "wifi_passphrase", "mqtt_broker", "mqtt_username", "mqtt_password"
std::vector<CREDENTIAL> const credentials = {
     { "ssid1", "********", "10.0.0.1", "mqttuser", "********"}

You can provide multiple wifi configurations:

// more than one wifi credentials are supported, upper one wins
// "ssid", "wifi_passphrase", "mqtt_broker", "mqtt_username", "mqtt_password"
std::vector<CREDENTIAL> const credentials = {
     { "ssid1", "********", "", "", ""}   // no MQTT
   , { "ssid2", "********", "10.14.0.1", "", ""} // MQTT without auth
   , { "ssid3", "********", "10.0.0.111", "mqttuser", "********"}  // MQTT with auth
};

Change the MQTT prefix and the topic names as you like. Currently the water counter value is published in watermeter/0/total and so on.

#define MQTT_PREFIX "watermeter/0" 
#define MQTT_total "/total"
#define MQTT_target "/target"
#define MQTT_ftemp "/flowtemp"
#define MQTT_atemp "/ambienttemp"
#define MQTT_info "/infocode"

Thanks to weetmuts for his great job on the wmbusmeters.