# RTLAMR

An rtl-sdr receiver for smart meters operating in the 900MHz ISM band.

### Error Correction

Each message contains a 16-bit checksum created by a BCH8 error correcting code. The checksum is computed over the last 4 bits of the preamble up through the least significant bits of the device identifier. Verification of the checksum acts as a sort of filter to reject invalid packets. This is necessary since the approach taken would generate a message for all received blocks regardless of whether the signal contains a message or not. In a previous version only the preamble was verified which had a high false-positive rate. This ensures that the received message is actually a message and not noise which appears to be a message.

Verification is done using a linear feedback shift register. The basic operation is as follows:

• Shift MSB in from signal (FIFO order).
• Shift register MSB out (again, FIFO).
• If the bit shifted out is 1 then XOR the contents of the register with the generator polynomial.
• Rinse and repeat.

The generator polynomial for this particular BCH implementation is:

The polynomial is converted to a bit string where 1’s exist at the power of each non-zero coefficient.

When the portion of the message which is checksummed has been completely shifted through the register, the value of the register is known as a syndrome. A syndrome whose value is zero, indicates the message is valid and there are no bit errors.

Error correction is currently implemented by pre-computing syndromes corresponding to all possible combinations of the number of errors to be corrected. These syndromes are stored in a map with the positions of each error the syndrome was computed from. Correction is done by calculating the syndrome and checking it’s existance in the precomputed syndromes. If the computed syndrome is either 0 or exists in the syndrome map then the message is correct(able).

Using this as the only criteria for a “good message” is impractical since the the error correction will pass messages which are complete noise. Also checking that the preamble is within a certain hamming distance of the expected preamble cuts back on this problem.

It is possible to determine the location of errors directly using syndrome values but this is currently unimplemented. As one of my professors would say “The theory behind this involves an awful lot of hand-waving.”

With the antenna that came with the dongle, I can reliably receive consumption messages from ~15 different meters from my apartment alone, with error correction for up to two errors this increases to ~19 meters.