New Member - Looking to hook into my home 433MHz transmissions...temp/power/etc...

Status
Not open for further replies.
Looks like its manchester encoded to me. Where a '1' is encoded as a 01, and a 0, is encoded as a 10.

The first lot of pulse trains are to train the RF receiver, to remove any DC offset (so there is no DC level, as RF recievers work on AC, so the signal must be balanced). So, it sends alternate 1's and 0's. Measure that bit period, and you have your datarate.

After the 10 pulses, there is a 'start of packet', which looks like 111000111101001011 ...etc.. This purposefully violates the manchester protocol, so it only ever appears as a 'start of packet', and is never repeated when sending data. Making the reciever 'find' the start of packet much easier. It is difficult to find the point where the 'start of packet' ends, and data begins.

Since after the SOP, there seems to be the same bits send for a while, I would imagine thats an address, then the bits that are different each time would be the temperature.

Your best bet is to write a small program for your Arduino, or whatever micro you're using, this should look for the start of packet, then decode everything after that with a manchester decoder. I'm sure there is source code available for this somewhere on the web, if not I have some for both PIC and AVR.

Also, at the end of the packet, there also appears to be the same data, this means it probably isn't a CRC checksum (which would be different for different data) so its probably a 'end of packet' bit string.

So two options?
1) do it manually convert all the waveforms to 1's and 0's in notepad, look for common bit strings. Even if you don't decode using manchester, your micro just has to look for the 'common elements', and record the parts that change. After this you have manchester encoded temperature data, which you can then also write down manually and decode it to see what the numbers are, and how they correspond to the temperature. - It may simply be a 8,10,12,16 bit number, or sometimes they send BCD (binary coded decimal) in which case its just a byte for each digital of the temperature. Example: 070.7F = bytes <0x00><0x07><0x00><0x07>.

2) Program your micro to do most of the work for you. Perhaps rigging up an LCD display to show the bits in the packet which are 'different'. Each time looking for the sync, start of frame, data, end of frame, but only recording the data.


Remember, there is no set standard that says the sync, SOF, EOF should be bytes, or a multiple of 8 bits... they could be anywhere from 6 to 20 bits long, since its a custom protocol. That means that, if you do it manually (in note pad) work in BITS rather than bytes. The same goes for using a micro, although it makes life difficult since 8-bit micro's can only store numbers as bytes.

I'll give it a closer look tomorrow

Blueteeth.
 
Last edited:
Thanks, it took 3 hours yesterday, nut I eventually "cracked" the code; is just as you say:
**broken link removed**

Uploaded with ImageShack.us

And this was the simple part...
Now I have to decode data from a weather station sensor which includes termometer, igrometer, anemometer and barometer!
The display is like this:
**broken link removed**

My station is named "Auriol h13726", but it's the same of Ventus WS155, Hama EWS 1500 and Meteoscan W155/W160 .
It has a quite weird behaviour, as the sensor has a LED which flashes every 30 seconds, but I can retrieve a signal every 4 minutes, so maybe there's some processing occurring onboard before transmitting (maybe averaging wind values?).

One of the burst-every-4-minutes looks like this:
**broken link removed**

Uploaded with ImageShack.us

But it will be quite hard to write down all data on the display every time the burst is received...
I'll try.
For now, all I can say is that, if BCD and Manchester are used here too, I'll have to look for A LOT of bits!
Temperature: xxx.x
Humidity: xx
Pressure: xxxx
Wind speed: xx.x? (m/s? mph?)
Wind direction: xxx?

Total: 16 digits ; 4 bits per digit (BCD) = 64 bits; 2 bits per number (Manchester) = 128 bits!
 
Good man!

I must say, as tedious as doing it 'by hand' is, it can be done, and is generally quicker and simpler than using expensive logic analysers which check for protocols. Sometimes its easier just to use a bit of grey matter and slog through it. Now you know the baud, and format, you *could* speed things up by writing code to do the donkey work fo you... but yeah, by the time you've done that, you coudl have decoded it all by hand anyway.

You're probably right about the averaging, since it provides a more stable (and accurate result) but who knows whats going on in there! I'm unsure if it would send all values as BCD, as its quite inefficient for radio comms, lots more bits to send. But given its slow update rate, they probably designed it for simplicity rather than narrow bandwidth.

Good to see Audacity being used as a logic analyser! I've used it for years, and even with more complicated projects/ contracts, I still haven't found the need for anything more. Still planning on writing my own app to do it though, so it automatically can decode manchester/biphase, NRZ, as well as convert to hex etc..

I guess for your bigger station, its jst a quesiton of collecting as many packets as you can. Who knows, iti might only send 'wind data' every 4th packet or something...just to make life more difficult for everyone

All the best,

Scott
 
Last edited:
Hi i have a xc-0346 weather station
by looking on the net i see there heaps that look the same
smae thing here i have captured the data
but i admit i am struggling to decode the data
a arduino sketch would be great
i tried **broken link removed**
sketch to no avail
my data looks more like the lacrosse format
so if a post the sample could somebody have a look
i am ripping my hair out
 
JUMPJACK: Pressure is measured in base station, not in "wind gauge". Yesterday I bought AURIOL H13726, and I will disassemble it as soon as I can ;o) I'll send pictures ASAP...
 
martymouse, if you can post some data we can try to help you decoding them.
I'm quite sure displayed data and received data re not the same (apart from temperature), they appear to be averaged, so here it is what you should do:
- detach batteries from all sensors and from base
- put battery into base and setup it
- put base in "search mode"
- start PC signal recording
- put battery into windmeter ny keeping the wind direction sensor in a position
- move the wind direction sensor 90° w.r.t. previous position and keep it there
- wait "up to 4 minutes" until base synchronizes with sensor, and take a snapshot of base display: it should show wind direction as coming from 90°E (or W). Also take note of syncronization signal recorded on PC
- keep the PC recording, and each time it receives a new signal from sensor, take note of the position of the signal in the recording and take a snapshot of base display; do this for at least 10 signals.

Save the 10+1 recordings (first synch-signal, others normal signals) into 11 separated file, associate each recording to its corresponding snapshot, pack all files and send them to us somewhere, we'll try to break the code. ;-)

Note: wind-meter must be always in same position during sampling, and you should not carry the sensor on hands to prevent it from warming up: just fix it somewhere and wait for data.

@S.D.Gotrek:
I really hope you can do it!Break it! Crack it! ;-)
 
JUMPJACK: Do not be impatient ;o))) When I open base station, I want to do several things. Especially carefully to see if the base contains an output port used by the manufacturer for calibration. As a second I want to add some small connector parallel to output of RF receiver. Is small, but non zero, chance that receiver makes decoding of manchester or other stream modification. Therewithal, the connector will be useful for LA connection.

Have a nice weekend

SDG
 
Not trying to hijack your thread but I've been thinking of adding 315/433MHz RX/TX sockets to a Home Automation I/O controller I'm working on. Seems mostly weather monitors use it but a socket is cheap to add to a PCB layout. Just thinking aloud...

As noted above these data streams are usually Manchester encoded.
 
By long time observation, I discovered a few things:
- wind gauge send data every 30s
- not all data packets probably contain all informations (I wait for data transmit, and after I start to move wind speed propeller - after 30s packed was transmitted and base station show 2,2km/h. In same time i stop propeller, but value on base station stay unchanged for 2 minutes).
- wind direction data are probably send every 30s, but some averaging is used (when wind arrow is long time stable wait for data transmit and immediately after it move arrow 90° to any direction - base station needs 3 packets to change direction)

P.S: I sent a message with a link to pictures, but message does not appear here. link is:
gotrekovo*rajce*idnes*cz/Weather_station/ (replace stars by dots)
 
Last edited:
I decided to start with the simplest block of system - rainmeter. Because the frequency of 433MHz is much used for many devices, and I wanted to read clear data, I opened the transmitter.
**broken link removed**
By digital oscilloscope I saved next pictures:
**broken link removed**
The first is the entire frame sent from the unit - cca 1s long
**broken link removed**
There are eight groups of short pulses
**broken link removed**
I used a little trick - I decoded sequence as 2400bps serial line ...

And the result? The entire sequence was decoded as a sequence of bytes 0xFF 0xDF. Because the sequence is a long series of pairs of pulses, the first pulse is "start", existence of second pulse indicate logical 0 /1. Bytes on oscilloscope represent log.L = 0xFF and log.H = 0xFD. I have some csv files with log of decoded bytes, so next step is try to decode it.
 
Last edited:
Something is wrong ;o(
Click by right button on missing picture, select "Copy image URL" and use this URL in other window.
 
Status
Not open for further replies.
Cookies are required to use this site. You must accept them to continue using the site. Learn more…