Smart Meters are seen as part of critical and secure infrastructure in the energy sector. Hence, the triad of data safety, data protection and data security play an important role when constructing suitable regulatory frameworks. However, in all security efforts a balance assessment between hazard potential and expenditure for the suggested security measures is needed. Obligations have to be designed according to the technologies in use and according to the potential risks involved. "Safety and security at all costs" should not inhibit innovation altogether. Regulators should therefore strive for a reasonable balance between security, costs and time to implement. In that sense, Germany’s regulatory framework for its smart meter roll-out is a negative example and should by no means serve as a role model.
With the Act on the Digitization of the Energy Transition in 2016 (Gesetz zur Digitalisierung der Energiewende), the previous federal government initiated a process for the mass distribution of modern metering equipment (that is digital meters without communication units) and intelligent metering systems (that is digital meters with communication units). These smart metering systems are intended to provide the technical and information basis for new business opportunities in the energy industry, provide consumers with a better overview of their consumption and place them at the center of activities. Originally, the Act is based on the requirements set out by the Energy Efficiency Directive in 2007 and subsequent obligations which were introduced by the EU with the Third Internal Market Package in 2009. The central part of the reform is the Measuring Point Operating Act (Messstellenbetriebsgesetz or in short MsBG) which – embedded in the Act on the Digitization of the Energy Transition – entered into force in September 2016. In 77 sections, the Act sets out new rules on the use of smart meters and smart meter gateways . The law also introduces specific and detailed requirements, both for the design of the smart meter devices and for the transmission of the data. The overall goal is to open the German energy market to digitization, while ensuring a high standard regarding data protection and ICT security.
The law also introduced a roll out plan regarding the installation of intelligent metering systems. The roll out was supposed to begin in 2017 and shall continue until 2032. The process comprises different roll out periods for different types of end consumers and plant operators, depending on the amount of energy they consume, or respectively the size of generation assets which they own and operate. In principle, the law requires meter operators to equip consumers with more than 6,000 kWh yearly consumption, and plant operators with an installed capacity of more than 7 kW, with intelligent metering systems. Below these thresholds, it is optional. In addition, the introduction of intelligent metering systems is tied to the compliance with a staggered price cap for annual costs in order to protect the end consumers from an extensive cost increase. Consumers have the option to choose an independent third-party metering operator if they are not satisfied with the solution offered by the Distribution System Operator (DSO), who in most cases is defined as the default metering operator if the consumer is not choosing a different operator.
As stipulated by the Measuring Point Operating Act, the general rollout of intelligent metering systems can only begin once the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik or in short BSI) has certified smart meter gateways (SMGW) from at least three manufacturers and issued a corresponding market declaration. The smart meter gateway is the central communication unit in an intelligent measuring system which is used for all communication connections, both internally and externally: It is used to connect measured consumption values with consumption displays. It is also used to connect devices and consumption systems. In addition to that, it is used to transmit control commands for consumption or generation systems, such as PV plants, battery storage or heat pumps for example. And finally, the smart meter gateway is used to organize the distribution and transmission of measured values to the respective authorized market participants by the Gateway Administrator.
According to the requirements set by the Metering Point Operating Act, the smart meter gateways must meet the basic security architecture defined by the BSI with regard to data protection and communication and be interoperable. These uniform technical and organizational specifications were written down in so-called protection profiles ("PP") and technical guidelines ("TR"), on the basis of which the BSI carries out the certification.
Massive delays in the BSI-certification process and other problems
Yet there is a massive delay and the certification of intelligent metering systems by the BSI has taken much longer than expected. The market declaration for the first generation was actually planned for 2017, but now most likely will occur in the beginning of 2020. There are various reasons for the extremely slow certification procedure: When the BSI was commissioned to define the basic security architecture with regard to interoperability, security and data protection, the legislator failed to set a target date and cost framework. Tremendously high expectations regarding the safety and security of the intelligent metering systems were transferred from the politicians to the implementing authorities. Technical guidelines were drawn up which reflect these very high requirements and subsequently, the certification of metering systems on the basis of these technical guidelines was started. As witnessed by the German energy industry, this procedure is awfully time-consuming and enormously slows down innovations.
The certification process includes an examination of how the smart meter gateway processes the received original measured values in different ways (before forwarding the respective results to the market participants or presenting it to the consumer). For reasons of data protection, it is precisely defined how the software must process the measured values according to the respective evaluation profiles in the gateway. All of this is laid down in so-called tariff application cases (TAF). According to the BSI's standardization strategy, the conformity of Generation 1 smart meter gateways with calibration law is evaluated on the basis of application rule 50.8 defined by the National Metrology Institute of Germany (Physikalisch-Technische Bundesanstalt or in short PTB). According to this rule, however, only the implementation of four out of the 13 tariff application cases - TAF 1, 2, 6 and 7 – so far has been determined. Therefore, the first certified smart meter gateway must only be able to transmit measured values for the following application cases:
- One measured value per cycle or year,
- A time-variable tariff for two tariff zones (corresponds to two measured values per cycle or year),
- One load profile per day with the aggregated meter readings in 15-minute resolution,
- The request for a measured value (final meter reading), for example when the consumer moves out or when the consumer switches his supplier, tariff or metering point operator.
As a result, the certified smart meter gateways approved by the first market declaration only provide the same data as previous meters. Out of the seven areas of application described in the specifications by the Forum Network Technology /Network Operation (Forum Netztechnik/Netzbetrieb or in short FNN) in the Association for Electrical, Electronic and Information Technologies (Verband der Elektrotechnik Elektronik Informationstechnik or in short VDE), the first gateway generation can only be used in the following areas: Transmission of measured values, special time of use-dependent tariffs and information provided directly to the consumer (via display or apps). Only the transmission of the measured values is new, everything else has been possible before. The ability to offer dynamic electricity price contracts, to perform generation and load management, as well as grid-supporting operational applications, on the other hand, are either limited or non-existent. However, these are actually the applications with the greatest innovation potential to support the energy transition towards a decentralized, decarbonized and digitalized energy system based on high shares of renewable energy generation.
Some of the BSI-certified gateways of the first generation can only be connected to one measuring device at a time, which prevents the acquisition and transmission of measured values from other meters that are also connected, such as gas meters. Many players see the multi-sector capability of metering systems as a starting point for offering consumers without relevant flexibility potential at least this one additional service.
For data-based business models, such as device-specific consumption detection, on the other hand, at least secondly values are required - with tariff application case 7 (TAF 7), data with a maximum resolution of 15 minutes can be obtained. These values are already inadequate for many current requirements. In other words, the smart meter gateway of the first generation is far from being able to offer customers any real benefit. Also, the home area network (HAN) interface in the smart meter gateway is not yet standardized. This means that the consumer has no really user-friendly possibility to retrieve data from his measuring system. It is not clear when standardization will take place. In addition, the question arises what will happen with the first-generation smart meter gateways already installed: If the further functionalities cannot be added by means of an update, these gateways would actually have to be replaced because they cannot be used for the requirements of market players or consumers.
Technically outdated, missing real-time data, control box not available
A total of 13 tariff application cases are defined in the Technical Guideline TR-03109-1v1.0 of the BSI, whose reproduction by the second generation SMGW must then be proven in the corresponding certification. A market declaration for second generation gateways again requires a certified offer from three manufacturers.
But even if the provision of real-time data will be covered with the market declaration for the second generation (when that will be, is not foreseeable at this point in time), for the implementation of the business models described above (and based on the certified smart meter gateway), the control box is still missing.
According to the description of VDE|FNN, the control box is the part of the metering system that executes the control operations in the customer's system. The smart meter gateway receives the control commands from the respective external authorized persons and forwards them to the control box. But also the control box’s final design is completely unclear. The BSI is still in the process of developing the technical requirements for the control function - presumably only the data transmission via the control box, the actual switching then takes place via another energy management system. However, other solutions have long been possible and should definitely be considered. Because - as described by VDE|FNN - it makes no sense to receive data via one communication channel and send the control commands via another. In this scenario, the user would have no control over the communication channel, which would however provide him with the decision basis for managing the generation plant or controllable load. It will probably be years before certified intelligent metering systems including control functions are available on the market.
BSI-certified gateways are lagging behind customer & market expectations
A future-proof energy market is depending on the implementation of new business models available already today. This is because the expansion of decentralised renewable energy generation plants, the demand for electric vehicles and the development of the necessary charging infrastructure, as well as investments in heat pumps and battery storage systems, are expected to increase significantly in the near future.
Meter operators, energy suppliers, service providers (such as aggregators for example) and other players, not least to mention network operators must very soon be able to manage the flexible operation of large asset numbers on the grid, supply them with energy, and optimize or compensate for volatile generation from renewable energies as well as peak loads in the electricity grid.
The intelligent metering systems approved by the first market declaration of the BSI do not meet the necessary technical requirements. This significantly slows down the introduction of any new business models. Consumers will also be disappointed if, for example, metering point operators install the certified metering systems in their homes, but - due to the limited functions of these meters - they will not find any meaningful or at least attractive offers provided by the market.
Possibilities of metering systems without BSI-certification
While everyone is waiting for the availability of the BSI-certified smart meter gateway, there are already metering systems available on the market that meet comparable security and data protection requirements as well as verification obligations already approved by metrological certifications and comply with international or industry standards. In addition, these metering systems already provide the functions and measured real-time values with the resolution required for the current and future business models outlined above. Together with the installed control devices, energy suppliers and service providers can already today manage the available flexibility potentials in a targeted manner and deliver offers to consumers which include attractive benefits.
Measuring Point Operating Act limits innovation
Competition in the German electricity market is extremely price-driven and consumers can now choose from a wide range of suppliers, electricity qualities and tariff models. Successful marketing of intelligent metering systems will therefore primarily focus on products and solutions for electricity, heating and mobility that address real customer needs. However, two factors were underestimated in the development of the Measuring Point Operating Act: On the one hand, the innovative strength of the companies and the rapid development of new business models. On the other hand, the many BSI-certification processes take up an incredible amount of time and resources. In order not to lose even more time, bne strongly recommends the opening of the Measuring Point Operating Act for accepting innovative metering systems and solutions already available on the market today.
Focus on consumer benefits
Without question, Germany has ambitious social and industrial policy goals. The energy system transformation continues to be accepted by society and is still supported by the majority of consumers. In addition to the moral support, consumers are also expected to take an active role in the energy transition. In the interest of consumer acceptance, the costs of intelligent metering systems must be accompanied by real added value for them, which they recognize as such. After all, the acceptance of the energy transition is at risk if the benefits promised to consumers fail to materialize.
If technologies that bring the energy transition to consumers are already available on the market, but will be slowed down for years to come due to the BSI-certified smart meter gateways, politics must act now. On top of this, the target group is also inadequate, as only some of the private consumers have sufficient flexibility potential to implement an attractive value-added offer. The majority of consumers will, however, be disappointed if they have to pay for an expensive meter but are unable to use it.
The digitization of metering should not be an end in itself, but should rather create the technical prerequisites for the implementation of the new business models in the interest of the energy transition. In addition to the BSI-certified smart meter gateway, there is also a lack of inexpensive basic technology that can be used as a simple version of the intelligent metering system, that is available at low cost and that fulfills the most important functions of measurement, measured value processing and measured value transmission. The smart meter gateway solution is simply too expensive, especially for many market segments and applications. However, a cost-effective basic version of the intelligent metering system would be particularly important for the approximately 34 million consumers with an annual consumption of less than 6,000 kWh - in order to be able to offer suitable value-added offers at lower prices to those consumers with lower electricity consumption. The application possibilities for prepaid meters are also more likely to be less than 6,000 kWh per year. A BSI-certified smart meter gateway oversized and too expensive for this application would quickly erode the advantages of using an intelligent metering system.
The modern metering facilities foreseen by the Measuring Point Operating Act are completely unsuitable for this purpose as they do not have a communication connection. The industry is currently developing solutions (e.g. plug-in modules for the infrared interface or solutions with integrated radio chips) which read out the data from the modern metering equipment, transmit it and make it available to the customer digitally. Without these, 80 percent of the consumers who receive a modern metering device would not have any additional benefit from the digital counter. Such solutions should - with the consent of the customer - be made possible in the future.
Since the intelligent metering systems according to the BSI standard will initially only be usable for a few applications, start-ups have developed innovative intelligent metering solutions which
(a) are at least as safe as those certified by the BSI,
(b) are made available at a significantly lower cost; and
(c) are able to transmit all measurement data required for the application in a timely manner (to the persons entitled in accordance with the Measuring Point Operating Act).
The feasibility of the innovative metering systems has already been demonstrated in projects (e.g. the SmartCable from ubitricity - an intelligent charging cable with a mobile electricity meter); and they meet all necessary security, data protection and calibration requirements. In addition, the hardware specified by the BSI cannot cover all the necessary functions. The applications of innovative metering systems go far beyond the functions planned by the German Ministry (BMWi) at the time. Naturally, their architecture cannot correspond to the narrow, construction plan-like specifications of the authorities. With regard to their architecture, innovative metering systems must therefore be allowed to deviate from BSI-certified metering systems.
Measuring Point Operating Act 2.0: Focus on objectives and minimum requirements, openness to innovation The introduction of the Measuring Point Operating Act seemed right and important at the time. However, there is now a need for improvement. Therefore, the lessons learnt from the process described above should be used and the necessary opening of the law for innovations should now take place in a timely manner. The concept of the BSI-certified Smart Meter Gateway as the multifunctional standard for a wide range of applications is not working - valuable and useful innovations for the digital energy revolution are prevented. In addition, the Measuring Point Operating Act’s rationale was in any case much more liberal than it is currently being implemented by the BSI.
In the German context, bne therefore proposes the following changes:
- Updating the Measuring Point Operating Act in line with the German government's energy policy projects under the coalition agreement: The Measuring Point Operating Act should create the technical prerequisites for achieving the new, ambitious targets for the expansion of renewable energies (65% by 2030), the flexibilization of the networks and in the field of electromobility.
- The development and definition of the safety and security standards for the metering systems as well as their verification within the framework of a certification procedure have so far been bundled at the BSI. The security standards developed by the BSI in this process are characterized by an extreme high degree of detail. In the future, the BSI should only define the basic requirements to be fulfilled by the new metering systems: What must trustworthy metering systems and communication infrastructures be able to do (with regard to measured value quality, minimum communication standards, security)? What does cybersecurity and data protection require for the administration and operation of metering systems? Changes and further development of the (intelligent) metering systems should be possible.
- The control box should be deleted from the BSI certification process. If there is a need for standardization for the control function (e.g. due to the requirements of the network operators), the BSI can specify general technical, safety and security as well as interoperability requirements for this as described above (what has to be fulfilled). It is essential to have a nationwide uniform regulation that does not differ from network operator to network operator. The manner in which, and where the control system is implemented in the intelligent metering system should, however, be the responsibility of the manufacturer.
- The market model for communication – which ensures the direct transmission of measured values to all authorized energy market participants – should be maintained. However, the Measuring Point Operating Act should be opened in such a way that the distribution of the measured values is not only carried out from the intelligent metering system, but can also be distributed by the metering point operator to the authorized persons.
- The general roll-out and installation requirements for intelligent metering systems should ensure that they only apply to consumers with high consumption and/or real flexibility potential.
- At least in the short term, within the transition to the first phase of the mandatory rollout, innovative systems should be protected from a replacement by first generation smart meter gateways which are limited in their functionality.
In the EU context, bne recommends to find appropriate ways in dealing with security in an insecure world:
- National Security Authorities should not become involved in defining the details and technical standards for smart meters as this has proven to be extremely costly and time-consuming. Security Authorities should define the high-level requirements. They should test and approve smart meters, but they should not be in charge of the system architecture and technical design.
- Systems are sometimes over-engineered and therefore too expensive. Setting the security bar very high for each component makes the system unaffordable, so it’s highly recommendable to go for commercial good practice instead and strive an appropriate balance between security and business needs. By using this approach, security implementation shall be based on the risks to be mitigated. In practice, this could also lead to dedicated and selective security implementation where needed.
- Adequate security standards are needed, but they should not be set at military’s highest protection level as this is effectively impeding all innovation and severely hampering commercial and competitive business activities.
- We are in the midst of a transformation to a different, in many respects new energy system - the framework for digitizing the energy sector should match this change. The regulation of the energy market has to be designed in such a way that innovative and consumer-oriented technologies and solutions can be taken up promptly while they are integrated into the system at the same time.
Who we are:
Bundesverband Neue Energiewirtschaft e.V. (bne) / Association of Energy Market Innovators – a strong voice for independent energy companies
Market, competition, innovation: bne and its members are committed to these three elements. After all, continuous development is the key to success in tomorrow‘s digital and renewable world of energy. For more than fifteen years, we have been representing the interests of grid-independent energy suppliers and energy service companies in Germany. Our members operate on all levels of the value chain: from electricity and gas distribution to smart energy and other services, right through to mobility. Making sure that new business models get a fair chance is at the core of our work.
Interest Representative Register ID: 3394645201-03