How a Smart Electricity Meter Is Made: Metrology, Comms and Privacy

A smart electricity meter is a small, legally regulated computer. A current sensor (a shunt, a current transformer or a Rogowski coil) and a voltage divider feed a metrology chip that samples both waveforms thousands of times a second and integrates them into kilowatt hours. An application processor stores that energy in time stamped intervals, drives a display and a disconnect relay, watches tamper sensors and talks to the utility over RF mesh, power line carrier or cellular, using protocols such as DLMS/COSEM or the ANSI C12 family.

This post follows a meter from silicon and copper to a commissioned device, then follows its data to the utility and back to you. It goes one level deeper than our posts on whether a cyberattack can shut down the power grid and how solar panels are made. Meter makers keep yields and test limits private, so example numbers are labelled as examples. Nothing here explains how to interfere with a meter; tamper detection is described only from the defender's side.

Key takeaways

• A smart meter has a metrology half that measures and a management half that records, displays, switches and communicates.
• The EU's Measuring Instruments Directive 2014/32/EU (applying from 20 April 2016) sets classes A, B and C for electricity meters and requires software "critical for metrological characteristics" to be identified and secured.
• North America uses the ANSI C12 series (C12.1, C12.20, C12.18, C12.19, C12.22); the IEC uses IEC 62052-11:2020 for general requirements and IEC 62053-21:2020 for classes 0,5, 1 and 2.
• Meters talk over RF mesh (Wi-SUN FAN, ISO/IEC/IEEE 32857:2026), power line carrier (G3-PLC under ITU-T G.9903, PRIME) or cellular IoT, carrying DLMS/COSEM (IEC 62056) or ANSI C12 protocols.
• Firmware updates must be signed, authorised and verified on the meter. NISTIR 7628 Rev. 1 names "integrity for firmware updates"; Great Britain adds a per message, per meter HMAC; Germany adds a certified gateway under BSI TR-03109.
• In Naperville Smart Meter Awareness v. City of Naperville (7th Cir., 16 August 2018), fifteen minute data collection was held a search, but a reasonable one on those facts.
• Households can usually get their own data: Green Button in North America, in home displays, and GDPR access rights in Europe.

From silicon and copper to a commissioned meter in one table

The table names each stage, where firmware and keys enter, and the typical check. The last three rows happen at the utility and in the field.

Two rows carry most of the security weight. Row 6 is where a meter gets its first identity, and row 10 is where the party that will actually command it replaces factory material with keys it controls. The section on firmware updates below returns to both.

What is inside a smart meter?

Inside the sealed case (do not open one; it carries mains voltage and breaking the seal is often an offence) the same blocks recur across makers.

The metrology front end or metrology SoC

The metrology section measures. Sigma delta analog to digital converters, one per current and voltage channel, feed a digital block called the metrology engine. It removes DC offset, corrects each sensor's phase shift, multiplies voltage and current sample by sample and accumulates active energy, and usually also computes reactive energy, RMS values, frequency and power factor and flags sags, swells and reversed current.

Two silicon arrangements are common. An analog front end chip does the conversion and the metrology maths and hands registers to a separate microcontroller over SPI or I2C. A metrology system on chip puts the converters, the engine and a general purpose microcontroller core on one die. The split matters for legal metrology because the EU directive asks makers to identify and secure the software that is "critical for metrological characteristics," and a clear hardware or software boundary around that code makes it easier to show an approval body what is legally relevant and what is not.

Current sensors: shunts, current transformers and Rogowski coils

The current sensor turns tens of amps into millivolts.

The current range a meter must cover is wide. A home meter may need to measure a few tens of milliamps from a standby load and up to 100 A or more on the same terminals, which is why makers declare the four currents that the EU directive defines: Ist (the start current), Imin, Itr (the transitional current above which the tightest error limit applies) and Imax.

Voltage sensing and power supply

A resistor divider, spread across several parts so a surge cannot arc across one, scales mains down for the ADC. The meter powers itself from the same mains through a small supply that must keep its own consumption low and stay up long enough after an outage to save readings and send a "last gasp" message.

The application processor, memory and real time clock

The management side is a microcontroller running the tariff registers, the load profile (interval data), the event log, the display, the optical port and the network stack, with flash sized to hold weeks of readings through a network outage. A real time clock backed by a lithium cell or supercapacitor keeps time through power cuts, because interval data and time of use tariffs mean nothing without it; the network synchronises it.

The disconnect relay

Many residential meters include a latching relay that can open the supply remotely, for example on move out or when a prepayment balance runs out. The European Commission's 2012 recommendation lists "remote on/off control of the supply and/or flow or power limitation" among its ten common minimum functions. The relay is why the disconnect command needs far stronger protection than a meter reading.

Communications module

The network interface is often a separate module, with its own firmware and often its own processor, so one meter design can ship with RF mesh, PLC or cellular. In Great Britain the wide area link and the home area network sit in a separate box, the communications hub, which the NCSC describes as mains powered via the electricity meter.

Tamper sensors

Meters watch for interference and record it; they do not prevent it. Typical sensors include a cover open switch and a terminal cover switch, a magnetic field sensor that notices fields strong enough to disturb a current transformer, reverse energy and neutral imbalance detection in the metrology engine, and logging of power loss and restoration. Each event is time stamped in the event log and, on a networked meter, sent to the head end as an alarm. The EU directive's essential requirement on "protection against corruption" asks that hardware critical to measurement can be secured and that "evidence of an intervention" is available for a reasonable period, which is the legal basis for those logs.

Display, optical port and test output

The display shows the legal register, the billing total, which the EU directive says "shall not be able to be reset during use." An optical port on the faceplate (ANSI C12.18 in North America) allows field reading, and a test LED blinks a fixed number of times per kilowatt hour so a bench can count energy without opening the case.

How does a meter turn waveforms into kilowatt hours?

The metrology engine computes active power as the average of instantaneous voltage times instantaneous current. For pure sine waves that equals V times I times the power factor, and energy is power integrated over time.

Worked example 1: one quarter hour of load

Take a single phase supply at 230 V RMS feeding a 10 A RMS load with a power factor of 0.9 (example values).

• Active power: 230 × 10 × 0.9 = 2,070 W, or 2.07 kW.
• Energy in one fifteen minute interval: 2.07 kW × 0.25 h = 0.5175 kWh.
• If the meter's test LED is set to an example constant of 1,000 impulses per kWh, it blinks 2,070 times an hour, about 0.575 times a second, and 517 or 518 times in that interval.
• The load profile records one value of 0.5175 kWh (or 517.5 Wh, depending on the register's scaler) against the interval's timestamp.

A test bench in the factory or a utility's lab counts the LED pulses over a fixed period and compares the count with a reference standard measuring the same current and voltage.

Worked example 2: is this meter within its class?

Error is computed as (energy registered minus true energy) divided by true energy, times 100. Suppose a reference standard measures 2.000 kWh during a test run and the meter under test registers 2.031 kWh (example values).

• Error = (2.031 minus 2.000) ÷ 2.000 × 100 = +1.55 percent.
• Under the EU directive, a class B meter operating between Imin and Itr at +5 °C to +30 °C may err by up to 2 percent, so this point passes for class B. A class C meter at the same point is allowed 1 percent, so the same reading fails class C.
• Above Itr the directive applies a tighter limit (that is how Itr is defined), so the same meter has to do better at normal load currents than at very light ones.

Factory calibration brings that error close to zero. The bench runs the meter at several currents (near Ist, near Itr, at a reference current and near Imax) and at unity, lagging and leading power factors, writes gain and phase corrections into protected memory, then retests.

Which accuracy standards apply, and how are meters type tested?

Legal metrology is the reason a meter has a legal register, a seal and a type approval number. The rules differ by region.

The EU: Measuring Instruments Directive 2014/32/EU

The Measuring Instruments Directive is the recast of the 2004 directive. It was adopted on 26 February 2014, published in the Official Journal on 29 March 2014, and its operative articles and annexes apply from 20 April 2016. Annex V, instrument MI-003, covers active electrical energy meters "intended for residential, commercial and light industrial use." It defines the current points above (Ist, Imin, Itr, Imax), requires the maker to declare a class index of A, B or C, and sets maximum permissible errors that widen with temperature. For a single phase meter between Imin and Itr, the limits in the directive's Table 2 are:

The directive also requires a power factor range of at least 0.5 inductive to 0.8 capacitive. Annex I, essential requirement 8 ("protection against corruption") is the part that reaches into firmware. It says the metrology must not be influenced "in any inadmissible way" by connected or remote devices, that software critical for measurement "shall be identified as such and shall be secured," that its identification must be easy to display, and that measurement data and metrologically important parameters must be protected against accidental or intentional corruption. That is why EU meters show a legally relevant firmware version and checksum, and why makers split legally relevant code from the rest so that a communications update does not reopen type approval.

International: the IEC 62052 and 62053 series

The IEC splits meter requirements in two. The IEC 62052 series holds what applies to every meter: IEC 62052-11:2020 carries the general requirements and test methods, and IEC 62052-31:2015 carries the safety requirements. The IEC 62053 series holds what is specific to each accuracy class. IEC 62053-21:2020, for example, "applies only to static watt-hour meters of accuracy classes 0,5, 1 and 2" for AC active energy on 50 Hz or 60 Hz networks, and only to their type tests. The IEC notes that the 2020 editions moved all general requirements and test methods out of the 2003 class standards (62053-21, -22, -23 and -24) into IEC 62052-11:2020, so the class standards now contain only class specific requirements.

The type tests in this family cover accuracy at many load points and the influence of voltage and frequency variation, harmonics, temperature, magnetic fields, electrostatic discharge, surges and radiated interference, as well as mechanical and climatic exposure. In Europe, EN versions of these standards (EN IEC 62053-21 is the European equivalent of the IEC edition) are what makers usually test against when they show conformity with the directive.

North America: the ANSI C12 series

North American revenue meters are built to the ANSI C12 family, published through NEMA. NEMA's own summary of the series describes the main parts this way:

• C12.1, Code for Electricity Metering (listed as C12.1-2014): performance criteria for new types of AC watthour meters, demand meters and registers, pulse devices and auxiliary devices, and acceptable in service performance levels for revenue meters.
• C12.20, Electricity Meters 0.1, 0.2 and 0.5 Accuracy Classes (listed as C12.20-2015): physical and performance criteria for the higher accuracy classes; where it differs from C12.1 and C12.10, it prevails.
• C12.18, Protocol Specification for ANSI Type 2 Optical Port (C12.18-2006, reaffirmed 2016, also IEEE 1701): communication between a meter and a handheld reader, laptop or other client through the optical port.
• C12.19, Utility Industry End Device Data Tables (C12.19-2012, also IEEE 1377): the table structure for the data inside a meter.
• C12.22, Protocol Specification for Interfacing to Data Communication Networks (C12.22-2012): extends C12.18, C12.21 and C12.19 so table data can travel over any reliable network.

Editions in this family are revised and consolidated over time, so a utility specification should name the edition it means. State utility commissions regulate retail electricity sales and set or approve utility meter testing programmes, which commonly reference this series.

What type testing looks like

Type testing is done once per design, on samples, at an independent laboratory or notified body: accuracy across current, voltage, frequency, power factor and temperature; immunity to disturbances, surges and magnetic fields; insulation, safety and durability. Production is then covered either by a certified quality system or by verification of meters. The approval file records which software is legally relevant and how to read its version and checksum, so a field meter can be checked against it.

Calibration and verification after installation

In service, utilities test statistically sampled lots, and many jurisdictions set verification periods after which a population is retested or replaced. A meter's own event log is part of any dispute.

How do smart meters communicate?

A smart meter has two network jobs: a wide area link back to the utility and, optionally, a local link into the home. The wide area link is usually one of three technology families, carrying one of two application protocol families.

RF mesh: Wi-SUN FAN

RF mesh meters form a self healing mesh in which each meter can relay its neighbours' traffic towards a collector or border router. The open standard here is the Wi-SUN Field Area Network (FAN) profile, built on the IEEE 802.15.4 smart utility network (SUN) radio. The Wi-SUN Alliance announced on 7 July 2026 that Wi-SUN FAN had been adopted as ISO/IEC/IEEE 32857:2026, and on 15 September 2026 that it had appointed its first European authorised FAN test lab. The Alliance certifies products against the FAN profile for interoperability, and says certified devices "include a digital certificate to authenticate entry" to a FAN network, issued through certificate authorities it has selected. That is the kind of credential provisioned in row 6 of the table above. Mesh suits dense suburbs and cities where meters are close enough to hear each other.

Power line carrier: G3-PLC and PRIME

Power line carrier sends data over the low voltage wires themselves, to a data concentrator usually installed at the distribution substation. G3-PLC is standardised as ITU-T G.9903, according to the G3-PLC Alliance, which also promotes a hybrid PLC and RF mode. PRIME (PoweRline Intelligent Metering Evolution) is a second open PLC standard whose alliance publishes specification versions 1.3 and 1.4 and lists ITU-T and IEEE 1901.2 adoption. PLC needs no radio licence or line of sight and works in basements and underground meter rooms, but its range and data rate depend on the noise and topology of each feeder.

Cellular: NB-IoT and LTE-M

Cellular meters use a mobile operator's low power IoT service (NB-IoT or LTE-M) to reach the head end directly, with no mesh or concentrator. Great Britain's model is a variant: the NCSC's description assumes, for simplicity, that the communication service providers carrying traffic between the national communications body and homes are mobile network operators. Cellular removes the utility's need to run a network but adds an operator, a SIM and a subscription to the trust chain.

DLMS/COSEM and IEC 62056

On top of the network sits an application protocol. Outside North America that is most often DLMS/COSEM, specified by the DLMS User Association and published by the IEC as the IEC 62056 series (and by CENELEC as EN 62056, and by ANSI as well). The DLMS UA publishes the COSEM object model and OBIS identification codes in the "Blue Book" and the DLMS application layer, lower layers and communication profiles in the "Green Book," with a "White Book" bundled with either. Every quantity a meter exposes, from the energy registers to the load profile and the clock, is modelled as an object that a client can read, write or act on. DLMS UA describes the security side as crypto agile security objects that manage "security suites, policies, and materials," with digital certificates used to attest device origin and for "zero trust commissioning," and says post quantum readiness is being added without breaking backwards compatibility.

ANSI C12.18, C12.19 and C12.22

North American meters typically use the ANSI C12 protocol family instead. C12.19 defines the meter's data as standardised tables (configuration, registers, load profile, event log). C12.18 is the protocol for reading those tables through the optical port. C12.22 carries C12.19 table data over any reliable network between the meter and the head end.

Comparison

How does advanced metering infrastructure fit together?

Advanced metering infrastructure (AMI) is everything between the meter and the bill.

• Meters measure, store intervals, log events and execute commands.
• The field network (mesh, PLC concentrators or cellular) carries traffic.
• The head end system manages communication with meters: scheduling reads, pushing configuration and firmware, receiving alarms and sending commands such as connect and disconnect.
• The meter data management system (MDMS) receives readings from the head end, validates them, estimates gaps and edits errors, and stores the billing quality data that billing, customer portals, outage management and planning systems consume.
• The home area network (HAN) connects the meter to an in home display or energy management device. Zigbee Smart Energy has been one option for that link, and the IEEE 2030.5 standard (the Smart Energy Profile application protocol, revised as IEEE 2030.5-2023) defines a RESTful, TCP/IP based application layer for "demand response, load control, time of day pricing, management of distributed generation, electric vehicles" across physical layers including IEEE 802.15.4, Wi-Fi and power line.

National designs add central bodies. In Great Britain, the NCSC describes a Data Communications Company (DCC) between suppliers, network operators and authorised third parties on one side and the meters on the other. In Germany, BSI TR-03109 defines a smart meter gateway with a security module, run by a licensed gateway administrator. NISTIR 7628 Rev. 1 treats AMI as one set of logical interfaces in a larger smart grid architecture.

Our LoRaWAN explainer and Zigbee, Thread and Matter explainer cover neighbouring radio stacks.

How are meter firmware updates signed and delivered?

Meters stay in service for many years (the NCSC article on Great Britain's design cites a 15 year "on-the-wall" life when discussing gas meters), so firmware will be updated many times. Each update is a remote code change to a device that can open a relay, so the update path has to answer three questions: who built this image, who is allowed to install it on this meter, and did it arrive intact.

The general pattern

1. The maker signs the image with a key held in a hardware security module, often with separate keys for metrology and communications firmware.
2. The utility tests the image in a lab and on a pilot group, then approves it.
3. The head end sends it to meters in blocks, sometimes by multicast in a mesh.
4. Each meter stores it in a second flash bank, verifies the maker's signature, checks that an authorised party approved activation, and refuses a lower version.
5. The meter activates it at a scheduled time through secure boot, reports the new version, and can fall back if the image fails to start.
6. In the EU, a change to the legally relevant part must be covered by the type approval, so makers keep most updates outside it.

What NISTIR 7628 says

NISTIR 7628 Rev. 1, "Guidelines for Smart Grid Cybersecurity," published in September 2014 in three volumes by the Smart Grid Interoperability Panel's cybersecurity committee and NIST, gives AMI as its example of interface level requirements: "authentication of the meter to the collector, confidentiality for privacy protection, and integrity for firmware updates." Volume 1 maps controls to logical interfaces; volume 2 is devoted to privacy; volume 3 covers supportive analyses. It is guidance, not regulation, and it asks organisations to tailor the requirements to their own risk.

What DLMS/COSEM provides

The DLMS UA's Blue Book (DLMS UA 1000-1 Edition 17, Part 2, dated 28 February 2025) lists the COSEM interface classes, including "Image transfer" (class_id 18), which moves a firmware image to a meter in blocks and activates it, and "Security setup" (class_id 64), which holds the security suite, policy and certificates for a client association. DLMS UA describes the current model as crypto agile with certificate based device attestation. Which suite a meter uses, and whether firmware images must be signed with a specific key, is set by each deployment's companion specification, so the questions to ask a vendor are which suite, which keys and which party signs images.

What Great Britain's design does

The NCSC's account of the GB design, written with the then Department of Energy and Climate Change, classes transactions carrying personal data as "sensitive" (encrypted for the recipient) and those that could affect supply, such as disconnect, as "critical" (signed by the authorised party). Every message to a meter also carries a keyed HMAC unique to that message and meter, which only the DCC or the meter can produce, so a message that bypasses the DCC is discarded, and DCC anomaly checks limit how many critical commands get through. Each certificate authority for meter identities signs a fixed number of meters and is then destroyed, and the keys that protect data and critical commands are created when parties take ownership. Reverse engineering one meter therefore yields enough to attack that meter only.

What Germany's TR-03109 requires

The BSI's TR-03109 family sets the technical requirements for the German intelligent metering system. The current documents listed by the BSI include the umbrella document (version 2.0.1), part 1 on interoperability of the gateway (version 1.1, with annexes on CMS based content encryption and signature, COSEM over HTTP web services, and the wireless and wired local metrological network interfaces), part 2 on the security module, part 3 on cryptographic requirements (which references BSI TR-03116 part 3 for algorithms and key lengths), part 4 on the smart metering PKI and part 6 on gateway administration. The gateway itself is certified against a Common Criteria protection profile, BSI-CC-PP-0073. Conformity with TR-03109 is shown through test labs recognised by the BSI.

Comparison

What can interval consumption data reveal?

A traditional meter gives one number a month. A smart meter reporting every fifteen minutes gives 96 numbers a day.

Load signatures and disaggregation

Appliances draw power in recognisable patterns. A refrigerator cycles a compressor on and off; a kettle draws a large, flat, short load; an electric vehicle charger draws a long, steady block; a heat pump modulates. Non intrusive load monitoring (NILM), also called disaggregation, uses those patterns to infer which appliances run and when. NISTIR 7628 volume 2 discusses disaggregation and illustrates it with hidden Markov models, and lists the privacy risks that follow: inferring when a home is occupied, sleeping and eating patterns, and the presence of specific devices. The finer the interval, the more an analyst can separate individual appliances; even at fifteen minutes, occupancy and large loads remain visible, as the Naperville court accepted at the pleading stage.

Worked example 3: how much data is that?

At fifteen minute intervals a meter produces 96 readings a day and 96 × 365 = 35,040 a year. A utility that keeps three years holds 105,120 readings per household. A neighbourhood of 10,000 homes yields about 350 million readings a year. Even at one reading per hour, which some customer portals show, a year is 8,760 values: enough to see the daily rhythm of a household and when it is away.

Worked example 4: reading occupancy from a baseline

Suppose a home's overnight fifteen minute readings sit at 0.05 kWh (a 200 W baseline from a fridge and standby devices) and its evening readings rise to 0.4 to 0.6 kWh (1.6 to 2.4 kW) between 18:00 and 22:00 on weekdays (example values). On a week when every interval stays near 0.05 kWh, the obvious inference is that nobody is home. No sophisticated model is needed for that; it is a threshold. This is why access to interval data needs the same care as access to location data.

Naperville Smart Meter Awareness v. City of Naperville

Naperville, Illinois, runs its own electric utility and used an $11 million Smart Grid Investment Grant to install meters that record every fifteen minutes and keep data for up to three years. Residents could not opt out (the "non-wireless" alternative collected the same data). A residents' group sued under the Fourth Amendment and the Illinois Constitution.

The Seventh Circuit (argued 27 March 2018, decided 16 August 2018) held two things. First, collecting the data is a search: relying on Kyllo v. United States, the court said the data reveals details about the home "that would be otherwise unavailable" without physical entry, and it rejected the city's third party doctrine argument because a choice "imposed by fiat is no choice at all." Second, the search was reasonable in this case, because the utility collected the data with no prosecutorial intent, utility staff rather than police reviewed it, the city's Smart Grid Customer Bill of Rights barred sharing with law enforcement without a warrant or court order, and the grid benefits were significant. The court affirmed the district court but cautioned that its answer "could change" with shorter intervals or easier access by law enforcement, and noted Naperville could have avoided the dispute by offering residents a genuine opportunity to consent.

The case binds only the Seventh Circuit and concerns a government utility, but it treats interval data as closer to a view inside the home than a billing record.

How can households see and control their own data?

Green Button in North America

Green Button began with a 2011 White House call to action. The US Department of Energy says it is built on the North American Energy Standards Board's ESPI standard, released in fall 2011: a common XML format for usage data plus a protocol for authorised sharing. Download My Data lets a customer download their own file; Connect My Data lets them authorise a third party to receive it automatically. DOE notes intervals of fifteen minutes, an hour, a day or a month depending on the utility. The Green Button Alliance certifies both.

In home displays and consumer access devices

In Great Britain, Ofgem's consumer guidance explains that the smart meter sends readings to the supplier automatically and that its in home display shows how much energy the household is using. Many meters elsewhere expose a local data port or a home area network link for consumer devices, and in some North American deployments a home energy device can read the meter over a Zigbee or IEEE 2030.5 link. Local reading keeps the fine grained data inside the home.

Opt outs and settings

Policies differ by country, state and utility. Some utilities allow a non communicating meter or a manual read, sometimes for a fee; some let customers choose how often detailed readings are collected; some, like Naperville at the time of the case, offer no opt out. Check your regulator's and your utility's own rules rather than assuming another region's. The NCSC article notes that a third party such as a price comparison service can obtain 13 months of readings in Great Britain only with the consumer's consent.

The EU: Recommendation 2012/148/EU and GDPR

The European Commission's Recommendation 2012/148/EU of 9 March 2012 on preparations for the roll out of smart metering systems asked Member States to require data protection impact assessments before roll out and to apply data protection by design and by default. Its ten common minimum functions for electricity meters begin with "provide readings directly to the customer and any third party designated by the consumer" and include secure data communications and fraud prevention and detection. Under the GDPR, a household's consumption data linked to an account is personal data, so the customer can ask the supplier or network operator for access, correction and, where the legal basis allows, erasure or portability.

Step by step: look at your own interval data, and keep a meter software build honest

Steps 1 to 3 are for households; 4 to 6 for teams building meter firmware or AMI software.

1. Download your data

In your utility's portal, look for Green Button or "download my data", choose the finest interval and longest range, and save the XML file. A CSV export works in a spreadsheet instead.

2. Summarise it locally

The ESPI format nests IntervalReading elements, each with a start time, a duration and a value, inside IntervalBlock elements. A ReadingType element gives the unit and a power of ten multiplier. This short script prints daily totals and the minimum overnight reading, which together show your baseline load and your away days. It runs offline; nothing leaves your machine.

# green_button_summary.py  (run: python3 green_button_summary.py usage.xml)
import sys, collections, datetime
import xml.etree.ElementTree as ET

ns = {"espi": "http://naesb.org/espi", "atom": "http://www.w3.org/2005/Atom"}
root = ET.parse(sys.argv[1]).getroot()

mult = 0
rt = root.find(".//espi:ReadingType/espi:powerOfTenMultiplier", ns)
if rt is not None:
    mult = int(rt.text)

daily = collections.defaultdict(float)
night_min = {}
for r in root.iter("{http://naesb.org/espi}IntervalReading"):
    start = int(r.find("espi:timePeriod/espi:start", ns).text)
    value = int(r.find("espi:value", ns).text) * (10 ** mult)   # usually Wh
    t = datetime.datetime.fromtimestamp(start, datetime.timezone.utc)
    day = t.date().isoformat()
    daily[day] += value
    if 1 <= t.hour < 5:
        night_min[day] = min(night_min.get(day, value), value)

for day in sorted(daily):
    print(day, f"{daily[day]/1000:.2f} kWh", "night min:", night_min.get(day))

We ran this script against the Green Button Alliance's own sample usage file (fifteen minute intervals, uom 72, multiplier 0, so values are watt hours) and it printed daily totals of roughly 93 kWh on weekdays and 115 kWh on weekend days, with weekend overnight minimums about three times the weekday ones: exactly the kind of household rhythm the privacy section describes. Check the units in your own file first; timestamps are seconds since 1970 in UTC, so shift the overnight window to your local time zone. If your utility's file uses a different structure, adjust the element names.

3. Decide who else gets it

Review which third parties hold a Connect My Data authorisation or similar consent, and revoke what you no longer use. In the EU, a subject access request to your supplier or network operator shows what they hold.

4. For meter and AMI software teams: produce an SBOM per firmware release

Meter firmware is mostly third party code: an RTOS, a network stack, a TLS or DTLS library, a DLMS or C12 library, a compression library. Produce a software bill of materials for every release. If you build on the Zephyr RTOS, its west tool can emit SPDX documents for a build:

# Zephyr: set CONFIG_BUILD_OUTPUT_META=y in the app's prj.conf first,
# then build and write SPDX 2.3 documents for that build directory
west build -b <your_board> app -d build
west spdx -d build
ls build/spdx/      # app.spdx, zephyr.spdx, build.spdx, modules-deps.spdx

Zephyr's documentation says west spdx writes SPDX 2.3 tag value documents by default (pass --spdx-version 3.0 for JSON-LD), records the source files and build outputs with hashes, and puts the documents in BUILD_DIR/spdx/. With sysbuild, point it at the application's own build directory.

For a Yocto based gateway or concentrator image, the Yocto Project documentation says the OpenEmbedded build system generates SPDX "by default" by inheriting the create-spdx class, so check that your distro has not removed it. Keep the SBOM with the signed image so a later advisory can be checked against what is actually in the field.

5. Sign images and verify the signature in the bootloader

If your bootloader is MCUboot, its imgtool signs images and the bootloader verifies them before boot. Keep the private key in an HSM or a signing service in production; the commands below are for a lab key only.

# Lab only: generate a key, export the public key for the bootloader, sign an image
imgtool keygen -k lab-ecdsa-p256.pem -t ecdsa-p256
imgtool getpub -k lab-ecdsa-p256.pem > lab_pubkey.c
imgtool sign --key lab-ecdsa-p256.pem --header-size 0x200 --align 8 \
  --version 2.4.1 --slot-size 0x60000 --pad-header app.bin app-signed.bin

MCUboot's documentation lists rsa-2048, rsa-3072, ecdsa-p256 and ed25519 key types, notes that the key type must match what the bootloader is configured to verify, and warns that the development key shipped with MCUboot is public and must never be used in production.

Enable downgrade prevention in the bootloader so an old, vulnerable image cannot be reinstalled, and make the head end refuse to push an image whose version is lower than the meter's.

6. Scan the SBOM and the back end in CI

The meter is only part of the system. The head end, the MDMS, the customer portal and its API are ordinary software built from open source packages and container images. Safeguard reads SPDX as JSON, XML or RDF and CycloneDX, so convert Zephyr's tag value output first with the SPDX project's pyspdxtools, then scan the firmware SBOM and the back end repository and image:

pip install spdx-tools
pyspdxtools -i build/spdx/app.spdx -o app.spdx.json
safeguard scan --sbom app.spdx.json
safeguard scan --dir ./head-end
safeguard scan --image registry.example.com/mdms-api:2026.10
ls ./output   # results as JSON

Common mistakes

• Treating the meter as the whole system. The head end, key management and portals can command thousands of meters. Ask what limits one compromised party in your design.
• One key for many meters. A shared key turns one reverse engineered meter into a fleet compromise. Per meter keys created at ownership contain the damage.
• Signing firmware but not authorising activation. A maker signature proves who built an image, not that the utility approved it for this meter today.
• Allowing downgrades. Without a monotonic version check, a signed but vulnerable old image stays installable.
• Mixing legally relevant and other code. In the EU, a network patch that touches metrology code can reopen type approval.
• Collecting finer data than the purpose needs. The Naperville court flagged interval length; EU impact assessments ask the same question.
• No SBOM for firmware. Without a per release SBOM, nobody can say which firmware versions carry a library named in a new advisory.

FAQ

What is inside a smart electricity meter?

A current sensor, a voltage divider, a metrology chip, an application processor with memory and a real time clock, a display and optical port, often a disconnect relay, tamper sensors, a backup cell, a power supply and a communications module.

How accurate are smart meters?

It depends on the class. An EU class B meter may err by up to 2 percent at light loads in normal temperatures and less at normal currents; class C is tighter. North American meters are commonly built to the ANSI C12.20 classes 0.5, 0.2 or 0.1.

How do smart meters send data to the utility?

Over RF mesh such as Wi-SUN FAN, power line carrier such as G3-PLC or PRIME, or cellular IoT, usually carrying DLMS/COSEM outside North America and ANSI C12 protocols inside it.

Can a smart meter tell what appliances I use?

Fine grained data can. Appliances have load signatures, and at fifteen minutes occupancy and large loads such as heating or vehicle charging are usually visible.

Is smart meter data collection a search under the Fourth Amendment?

In Naperville (7th Cir. 2018) the court held a city utility's fifteen minute collection a search, but a reasonable one on those facts, and said shorter intervals or easier police access could change that.

How are smart meter firmware updates secured?

The maker signs the image, an authorised party approves and pushes it, and the meter checks signature and version before activating it under secure boot.

What is Green Button data?

A standard way to download your own usage (Download My Data) or authorise a third party to receive it (Connect My Data), based on the NAESB ESPI standard.

Can I opt out of a smart meter?

It depends on your utility and regulator. Some offer non communicating meters or manual reads, sometimes for a fee; some do not.

What is a smart meter gateway?

In Germany, a certified unit defined by BSI TR-03109 that sits between a building's meters and the outside world and is run by a licensed gateway administrator.

Where Safeguard fits, and where it does not

Safeguard does not test meters, analyse firmware binaries, check metrology or manage devices. It scans repositories, container images and SBOM files for known vulnerable open source components, shows which projects contain a given component and version, ranks findings with reachability analysis, evaluates policies and gates, and can open fix pull requests when a fixed version exists (autonomous remediation is off by default). For a meter maker that means the SBOM its firmware build emits and the services around it; for a utility, the head end, MDMS and portal code it builds.

Meter firmware, communications modules and AMI back ends are built from open source operating systems, network and TLS stacks and protocol libraries, and those components get advisories like any others. The section below applies to software and images you build and ship; a meter's own signed firmware still has to come from its maker, so the fit for the device itself is indirect.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session: asked to fix a lodash CVE, the assistant reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same flow fits a utility's customer portal or a head end service that shows interval data to customers.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. That suits a meter firmware team that wants to scan the SBOM file its embedded build writes, on the build host, without sending the build anywhere else.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. An AMI team could then ask which of its projects carry a component named in a TLS or RTOS advisory.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• NIST, IR 7628 Rev. 1, Guidelines for Smart Grid Cybersecurity
• NIST, NISTIR 7628 Rev. 1 full text (PDF, September 2014)
• Directive 2014/32/EU, Measuring Instruments Directive (recast), Official Journal L 96, 29 March 2014
• Commission Recommendation 2012/148/EU of 9 March 2012 on preparations for the roll-out of smart metering systems
• US Court of Appeals for the Seventh Circuit, Naperville Smart Meter Awareness v. City of Naperville, No. 16-3766 (16 August 2018), via GovInfo
• NCSC, The smart security behind the GB Smart Metering System
• BSI, Technical Guideline TR-03109
• DLMS User Association
• DLMS User Association, Core specifications
• DLMS User Association, DLMS/COSEM data model
• Wi-SUN Alliance
• G3-PLC Alliance
• PRIME Alliance
• IEEE SA, IEEE 2030.5 Standard for Smart Energy Profile Application Protocol
• US Department of Energy, Green Button
• Green Button Alliance
• US Department of Energy, Grid modernization and the smart grid
• Wi-SUN Alliance, Wi-SUN FAN certification
• DLMS UA, Excerpts of DLMS UA 1000-1 Ed. 17 Part 2, COSEM interface classes (Blue Book, February 2025)
• NEMA, Summary of ANSI C12 Standards (PDF)
• IEC, IEC 62053-21:2020 Static meters for AC active energy (classes 0,5, 1 and 2)
• Ofgem, Getting a smart meter
• Green Button Alliance, OpenESPI sample usage data file
• Zephyr Project, west spdx (software bill of materials)
• Yocto Project, Creating a Software Bill of Materials
• MCUboot, Image tool
• SPDX, tools-python (pyspdxtools)

Last reviewed: 24 October 2026.