A long ago I bought a 433 Mhz wireless weather station in LIDL. It came with one remote temperature sensor and the possibility to show up to three other sensors.
Lately I wanted to show other temperatures measured by an arduino device by using a cheap 433 transmitter to send it to the station. Unfortunately I found no libraries for this concrete weather station, so I decided to try to reverse engineer the protocol.
I started by connecting a DSO nano oscilloscope to the data line of the remote temperature sensor transmitter, and looking at the waveform in Audacity:
There I identified the two symbols, coding digital '0' and digital '1' (I did not know which one exactly). Furthermore, the sequence of 28 bits was repeated 8 times in a frame.
With this information I searched the internet for similar protocols and I found this (spanish) and this, which dramatically accelerated my reverse engineering process, as most information could be taken directly from those posts.
When trying to send from the arduino, I could replicate the frames sniffed with the DSO, but every try to send a different temperature failed. So I assumed so checksum had to be present.
In order to decode the frame I recorded several frames with different temperatures, some forcing the transmitter to send and others just letting it work. This allowed me to identify the changing bits that could be the checksum. I considered one-bit and multi-bit parity as well as CRC (I originally discarded checksum, as only 4 bits were available).
Failure after failure I decided to try the checksum as sum of bytes taking as a result either the most significant nibble or less significant nibble, which also failed. Then, I realized that I should try options with higher entropy, which just discarding half of a byte were not, so I decided to start focusing in nibble operations... and that was it. The first four bits were sum of nibbles minus one!!
So summarizing:
- 4 bits: sum of nibbles minus one
- 8 bits: thermometer identified
- 12 bits: temperature in two's complement
- 2 bits: channel (0-2)
- 1 bit: low battery indication
- 1 bit: forced send from transmitter (causes the receiver to beep).
I decided to make the code available in Github under GPL v3 license.
Special thanks go to +dephiox and +Alejandro Vargas, as they managed most parts of the protocol.
Unfortunately, the receiver code of Alejandro did not work for me (maybe because of too much electromagnetic noise). Lately, +Petr StehlĂk tested my code (look at his post) and has created a receiver code, which works for him and which he intends to upload to Github.
I am very much pleased with the contents you have mentioned. I wanted to thank you for this great article. puppy car seat
ReplyDelete