Analyze temperature sensor RF 433.92MHz

Anything not related to a specific project.

Analyze temperature sensor RF 433.92MHz

Postby crinch » Sat Apr 19, 2014 3:14 am

Hi to all, this is my first messagge on this great forum.

I bought a RTL-SDR and now with GNU Radio I'm analyzing a signal of a temperature sensor which trasmit data at 433.92 MHz (433.75 MHz).
I attached 2 capture in wave.zip with 2 waves (2 temperature 17.3 and 17.5 °C) and there is also test.grc used in GNU Radio Companion for capture the signal.
Someone could you help me to understand which encode is used for this trasmission?
There are 8 pulses at the start a pause about 400 ms and after there are 50 pulses.
Each pulse is length about 80/90 ms, sometimes between the pulses there is a pause about 20ms and sometimes about 100ms.
Maybe is a Manchester encoding?
This signal is repeated 3 times, I removed from the waves.

Thank you to all for suggestions.
Attachments
grc.zip
(1.07 KiB) Downloaded 340 times
wave.zip
(691.16 KiB) Downloaded 227 times
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Sat Apr 19, 2014 3:26 am

I attach also a screenshot of audacity for temperature 17.5 °C
Attachments
17_5.png
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby NsN » Sat Apr 19, 2014 9:07 am

I think another capture with a bigger temperature difference would be very helpful.

At the moment I would guess, that the signal is simply encoded as:

80ms High, 80ms Low = 0
80ms High, 80ms High = 1

But simply from that I can't really narrow down the data format.

Just for others here are both signals aligned:
Image
NsN
Newbie
Newbie
 
Posts: 38
Joined: Thu Oct 13, 2011 10:21 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Sat Apr 19, 2014 10:14 am

This capture for 27.2 °C
I tried to decode the signal with length pause, 20 ms = 0 and 100 ms = 1 and viceversa, but I can't extract nothing
Attachments
27_2.zip
(440.28 KiB) Downloaded 215 times
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Sat Apr 19, 2014 10:44 am

Capture 39.3 °C
In the previous capture 27.2 I see only 46 pulse after the 400 ms pause.
I will try another capture.

--------------------------------
Capture 26.8 °C
Also in this case there aren't 50 pulses but only 42, I'm sure this capture is correct.

--------------------------------
Capture 48.8 °C
42 pulses
Attachments
48_8.zip
(373.72 KiB) Downloaded 175 times
26_8.zip
(325.84 KiB) Downloaded 159 times
39_3.zip
(403.09 KiB) Downloaded 213 times
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby NsN » Sat Apr 19, 2014 1:02 pm

This would be my interpretation:

Image

I don't really know how to explain the different length. But if you consider the first 16 or so bits, it their value seems to increase with rising temperature.

Edit:
I just noticed all transmissions seem to end with a 1, maybe with a fixed length packet the transmission is ended with the last 1 and any remaining bits can be assumed to be 0.
NsN
Newbie
Newbie
 
Posts: 38
Joined: Thu Oct 13, 2011 10:21 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Sun Apr 20, 2014 2:35 am

I like your interpretation.
So it should be: pulse 80 ms + 100 ms. If in next 100ms there is a pulse we have a bit 1 else bit 0.
This is a photo of my little station. I bought it some years ago in LIDL's supermarket.
station.jpg

In the circuit of sensor I can't see sensors maybe it use internal ADC sensor's temperature of microcontroller
pcb.jpg
pcb.jpg (45.25 KiB) Viewed 10770 times

The range of sensor is -20 / +60 °C resolution 0.1, so a 10 bit ADC it's should be good.
I will continue to analyze it.
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Sun Apr 20, 2014 4:01 am

I tried to analyze with rtl_433 on github and this is the result:

Code: Select all
./rtl_433 -a -f 433750000 -s 2400000
21.8 °C
[00] {7} 00 : 00000000
[01] {45} f2 7f cf 93 e4 90 : 11110010 01111111 11001111 10010011 11100100 10010000

22.5°C
[00] {7} 00 : 00000000
[01] {45} f2 7f cf 39 93 90 : 11110010 01111111 11001111 00111001 10010011 10010000

23.9°C
[00] {7} 00 : 00000000
[01] {45} f2 7f cf 24 e6 70 : 11110010 01111111 11001111 00100100 11100110 01110000

25.2°C
[00] {7} 00 : 00000000
[01] {45} f2 7f ce 67 33 90 : 11110010 01111111 11001110 01100111 00110011 10010000

26.4°C
[00] {7} 00 : 00000000
[01] {45} f2 7f ce 4e 72 70 : 11110010 01111111 11001110 01001110 01110010 01110000

27.3°C
[00] {7} 00 : 00000000
[01] {49} f2 7f ce 49 c9 33 00 : 11110010 01111111 11001110 01001001 11001001 00110011 00000000

28.1°C
[00] {7} 00 : 00000000
[01] {45} f2 7f cc fe 64 90 : 11110010 01111111 11001100 11111110 01100100 10010000

28.8°C
[00] {7} 00 : 00000000
[01] {45} f2 7f cc f3 c9 30 : 11110010 01111111 11001100 11110011 11001001 00110000

29.4°C
[00] {7} 00 : 00000000
[01] {45} f2 7f cc e6 7c 90 : 11110010 01111111 11001100 11100110 01111100 10010000

29.8°C
[00] {7} 00 : 00000000
[01] {49} f2 7f cc e4 f2 49 00 : 11110010 01111111 11001100 11100100 11110010 01001001 00000000

It's just for fun I think interpretation of NsS is better.
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Mon Apr 21, 2014 9:47 am

I developed a little sketch for Arduino, I emulate the trasmission for temperature 48.8 and 39.3 °C.
I have used this trasmitter module
DATA of trasmitter is linked to D9 and a LED with resistor 470 Ohm is linked to D0
Both temperatures are working, but I yet don't understand which is the relationship between bits and temperature

Code: Select all
const int LED = 0; // pin LED
const int TX = 9;  // pin TX

void setup()
{
    pinMode(LED, OUTPUT);
    pinMode(TX, OUTPUT);
}

void loop()
{
    digitalWrite(LED, HIGH); // Flash a light to show transmitting
   
    for(int iNdx=0;iNdx<3;iNdx++) // repeat trasmission 3 times with delay 33ms....
    {
        // preamble 4 bit 1
        trans1();
        trans1();
        trans1();
        trans1();
        delayMicroseconds(7400);
        // constant ID => 00001010
        trans0();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans1();
        trans0();
        // bits for 48.8°C
        /*
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans0();
        trans0();
        trans0();
        trans1();
        */
        // bit for 39.3 °C
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans1();
        trans0();
        trans1();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans0();
        trans0();
        trans1();
        trans0();
        trans1();
        trans0();
        trans0();
        trans1();
        trans0();
        trans0();
        trans1();
        trans0();
        trans1();
       
        delay(33);
    }
    digitalWrite(LED, LOW);
    delay(10000);
}

void trans1()
{
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(300);
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(300);
}

void trans0()
{
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(2100);
}
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby EasyRider » Tue Apr 22, 2014 3:40 am

Well, this sort of thing takes a bit of training to get right (and a bit of "getting into the heads" of the original programmers, understanding which would be the simplest interpretation applicable to the waveform you get - which invariably turns out is the one they did choose).

For instance, I believe your interpretation of bit encoding isn't quite right - it's not 1 burst ='0', 2 burst = '1' but rather 1 burst = '0', 3 burst = '1'; they are all separated by equal 'silence'. Obviously, that leaves no room for the final 2 bursts at the end of each message - I just interpret it as 'not a bit, just signalling the end of message' and I note it with 'x'. One advantage of this interpretation is that all lengths are suddenly equal as number of bits. The other advantage is that (separated at just the right points) the bit-stream immediately makes sense - the key is that the number of degrees is NOT transmitted as a single value encoded as a single binary number. So here's my interpretation (only the part after the 'ID'):

17.3 000000 0001 0111 0011 1001 x
17.5 000000 0001 0111 0110 1100 x -> this is a red herring, I believe it's an incorrectly associated value. It's in fact 17.6...
26.8 000000 0010 0110 1000 0000 x
39.3 000000 0011 1001 0011 0101 x
48.8 000000 0100 1000 1000 1000 x

...see the pattern yet...? ;)
User avatar
EasyRider
Newbie
Newbie
 
Posts: 37
Joined: Wed Mar 24, 2010 8:00 am
Location: Romania

Re: Analyze temperature sensor RF 433.92MHz

Postby EasyRider » Tue Apr 22, 2014 3:49 am

...oh, and it's nice to see the programmers actually had a sense of humour. I can't of course be sure, but I'd be willing to bet they take the four groups of four bits, XOR them together as they receive them, then check that the result is invariably 1100. Which, interpreted as a hex number, is...

...hilarity, innit?

EDIT: ok, as fun as it would have been - once you include the 'ID' in the 'checking', you sort of end up with a much plainer '0000'... Eh, a pity...
User avatar
EasyRider
Newbie
Newbie
 
Posts: 37
Joined: Wed Mar 24, 2010 8:00 am
Location: Romania

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Tue Apr 22, 2014 6:41 am

EasyRider wrote:the key is that the number of degrees is NOT transmitted as a single value encoded as a single binary number. So here's my interpretation (only the part after the 'ID'):
Very interesting your interpretation.
Maybe ID are 12 bit. 0000 11 000000.
So:
preamble is 8 burst | silence 7.4 ms | 12 bit ID | 12 bit data | 4 bit CRC XOR 1100 | end of bits 2 burst

EasyRider wrote:17.5 000000 0001 0111 0110 1100 x -> this is a red herring, I believe it's an incorrectly associated value. It's in fact 17.6...

...see the pattern yet...? ;)
I will try to sniff the temperature 17.5 and 17.6 if I catch it.

I will try also temperature below 0 for understand better.
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Tue Apr 22, 2014 1:58 pm

New sketch for emulate the sensor.
I can't test temperature below 0°C for the moment, but from 0 to 69.9 is working very well.
I will develope also a decoder.
I tried to change the constant ID / sensor ID, but doesn't work. I tried also to XOR the data with sensor ID, but doesn't work. Just for fun.

Code: Select all
const int LED = 8; // pin LED
const int TX = 9;  // pin TX

int iTemp = 0;

void setup()
{
    pinMode(LED, OUTPUT);
    pinMode(TX, OUTPUT);
}

void loop()
{
    digitalWrite(LED, HIGH); // Flash a light to show transmitting
   
    for(int iNdx=0;iNdx<3;iNdx++) // repeat trasmission 3 times with delay 33ms....
    {
        preamble();
        delayMicroseconds(7700);
        txOneHalfByte(0xC0,0);
        txOneHalfByte(iTemp,1);
        endBits();
        delay(33);
    }
    digitalWrite(LED, LOW);
    delay(10000);
    iTemp+=10;
}

void txOneHalfByte(unsigned int iByte,unsigned char bCrc)
{
    for(int iNdx=11;iNdx>=0;iNdx--)
    {
        if(iByte & (1<<iNdx))
            txBit1(1);
        else
            txBit0();
    }
    if(bCrc)
    {
        int iCrc = (iByte >> 8) ^ (iByte >> 4) ^ (iByte & 0xF) ^ 0xC;
        for(int iNdx=3;iNdx>=0;iNdx--)
        {
            if(iCrc & (1<<iNdx))
                txBit1(1);
            else
                txBit0();
        }
    }
}

void endBits()
{
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(300);
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
}

void preamble()
{
    txBit1(0);
    txBit1(0);
    endBits();
}

void txBit1(unsigned char bLong)
{
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(300);
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(300);
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    if(bLong)
        delayMicroseconds(2100);
    else
        delayMicroseconds(300);
}

void txBit0()
{
    digitalWrite(TX, HIGH);
    delayMicroseconds(1500);
    digitalWrite(TX, LOW);
    delayMicroseconds(2100);
}


Thank you to all for the help
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby crinch » Tue Apr 22, 2014 2:55 pm

I have found how to send negative temperature.
Data are 16 bit first 4 bit (high nibble of first byte) tell if the value is negative. When the first nibble is 0xF or 0x7 the value in next 12 bit become negative. I tried until -49.9°C and is OK at -50.0°C the temperature is not displayed.
This nibble must be used in CRC.

preamble is 8 burst | silence 7.7 ms | 8 bit ID (0000 1100) | 16 bit data | 4 bit CRC data XOR 1100 (0xC) | end of bits 2 burst
crinch
Newbie
Newbie
 
Posts: 12
Joined: Sat Apr 19, 2014 2:44 am

Re: Analyze temperature sensor RF 433.92MHz

Postby EasyRider » Tue Apr 22, 2014 3:30 pm

Glad to hear you're making progress. Regarding other IDs - you probably would need to re-pair the receiver with the "new" transmitter ID, your original user manual should tell you how that should be done; it's quite possible there are some special messages involved too, used by the transmitter to announce it's in "pair" mode.

About the CRC - the "C (1100)" factor I first suggested was a mistake, it looks like that simply because that's what the current ID also happens to look like. In reality, there is no special "1100" element - you should just take every nibble, XOR them together, and transmit the final result as the "CRC nibble" at the end; the only thing that matters is that XOR-ing all nibbles from the start to finish (including the ID and the CRC) should result in "0000".
User avatar
EasyRider
Newbie
Newbie
 
Posts: 37
Joined: Wed Mar 24, 2010 8:00 am
Location: Romania

Next

Return to General discussion