ERT family · R900 · reference
What the open tools can decode
Five message types cover almost everything a residential SDR will hear on 902–928 MHz. Which one you get is decided by the meter, not by you.
Almost all decodable residential meter traffic in the US belongs to the ERT family — Encoder Receiver Transmitter, an Itron design that predates the smart meter era and survived because it works. R900 is Neptune's separate lineage for water.
The important structural fact: these are broadcast, not polled. ERT devices transmit in what the trade calls bubble-up mode — no wake-up tone, no handshake, no request. The meter simply shouts a short packet every few seconds and goes back to sleep. Receiving one is entirely passive; there is nothing to transmit and nothing to negotiate.
| Message | Typically | Carries | Payload style |
|---|---|---|---|
| SCM | gas, water, electric | Cumulative total, tamper flags | Odometer |
| SCM+ | gas, water, electric | Cumulative total, longer IDs | Odometer |
| IDM | electric | 47 × 5-minute intervals | Differential |
| R900 | water (Neptune) | Total, leak flag | Odometer + state |
| R900BCD | water | Total as decimal digits | Odometer |
Odometer versus differential
This is the distinction that matters most, and it is not about signal quality or protocol age — it changes what you can build.
Odometer messages (SCM, SCM+, R900) carry one number that only ever goes up. Consumption is the difference between two readings, so your time resolution is capped by how often you successfully decode, and a missed packet is a permanent hole in your series.
Differential messages (IDM) carry consumption per interval for dozens of recent intervals. Each packet is self-contained history, so a missed packet costs you nothing — the next successful decode backfills it. If you are choosing which meter at your address to invest effort in and one of them speaks IDM, that is the one.
Which tool decodes which
| Tool | Covers | Best for |
|---|---|---|
| rtlamr | SCM, SCM+, IDM, R900, R900BCD | Production. Filter to your ID and leave it running. |
| rtl_433 | Hundreds of ISM protocols including meters | The first sweep. Tries everything at once, so it finds what you did not know to look for. |
Start promiscuous, then narrow. rtl_433 in its default mode will tell you what
is actually on your band — including your neighbours' meters, your car's tyre
sensors, and every 433/915 MHz doorbell and weather station within range.
Once you know your meter's ID and message type, switch to rtlamr and filter.
What you will not decode
- Proprietary mesh. Most modern electric AMI networks. Two-way, relayed meter-to-meter, frequently encrypted. You may see the energy in a spectrum sweep and never get a byte out of it.
- Cellular modules. Some newer meters skip local radio entirely and report over a mobile network. There is no local broadcast at all.
- Anything outside 902–928. 288 of the meter radios in the FCC dataset transmit somewhere else — licensed UHF near 450–470 MHz, the old 950–960 MHz utility band, or 2.4 GHz. An RTL-SDR can tune the first two but the open decoders are built around the 900 MHz ERT family.
- Inductive touch-read pads. Sub-1 MHz coupling for a handheld wand. Not a radio in any useful sense.
When the lookup reports a grant of 910–920 MHz, that is the
span the device is authorised to operate across, and it will typically
hop within it. It is where to listen, not a number to type into
rtl_433 -f. Sweep the range; do not park on an endpoint.