[Solved] Bresser 7002000 weather station sensor decoding riddle

The data in your initial post does not tie up correctly. It seems the temperature/humidity value you added on the end are out of step. The two example that have the same consecutive temperature/humidity readings don't line up with the data being identical.
Are we to assume all the readings are out?

Green highlight is matching data but text on end (22.4 43) does not line up

Clipboard-1.jpg

EDIT:
Does this work with your data?

@Riva: yes, I noticed that, too and thought it might be one off. All I can say is that I noted down the displayed values as soon as I received the telegram. It may be the sensor will show new readings already that are later sent to the base station at the end of a cycle only. Would not make too much sense to me to keep the base one behind, though.

Regarding the Github link: no, does not fit seemingly.

I can see no sensible pattern in the data you supplied so do you have an example image of the transmission data? Like Paul I think it's less likely that the signal is using Manchester encoding and a picture paints a thousand words data points.

@Riva: all I can provide right now are the tick data in the above post. I will try to rig up my SDR and Audacity. If I get some waves I will post it.

In the meantime I added inverted, reverse and inverted+reverse outputs to my receiver program, but still no match.

rtl_433 with my SDR picked the following from the device:

Detected OOK package
Analyzing pulses...
Total count:   66,  width: 20058                (80.2 ms)
Pulse width distribution:
 [ 0] count:   42,  width:   215 [214;219]      ( 860 us)
 [ 1] count:   24,  width:    94 [92;96]        ( 376 us)
Gap width distribution:
 [ 0] count:   41,  width:    89 [88;91]        ( 356 us)
 [ 1] count:   24,  width:   211 [210;213]      ( 844 us)
Pulse period distribution:
 [ 0] count:   65,  width:   305 [303;309]      (1220 us)
Level estimates [high, low]:  15872,    241
Frequency offsets [F1, F2]:  -12406,      0     (-47.3 kHz, +0.0 kHz)
Guessing modulation: Pulse Width Modulation with fixed period
Attempting demodulation... short_limit: 154, long_limit: 214, reset_limit: 214, demod_arg: 0
pulse_demod_pwm(): Analyzer Device
bitbuffer:: Number of rows: 1
[00] {66} 00 00 c4 3d 8a 5e 3c ac 00

This would be these bits:

0000 0000 0000 0000 1100 0100 0011 1101 1000 1010 0101 1110 0011 1100 1010 1100 0000 0000

The displayed data was 21.8°C and 38% at that time. Again I can not detect the data in these bits.

Next will be Audacity :wink:

I tried with SDRsharp and Audacity, but got a very coarse signal only. Then I used Universal Radio Hacker and it got better:

You can see the long and short phases/pauses here already. If you are interested in zoomed data, just tell me :slight_smile:

It does not look like Manchester but I still cannot get the data to look right.

It must be something simple - I would not expect the tiny brain of the sensor doing something elaborate.
The initial long-short pulses most probably will be some calibration or locking pattern for the receiver. Then the first short-long must be the start marker; perhaps even more. So the data will be in the last ~40-48 pulses.
Humidity has values between 0 and 100, so we would need 7 bits at least for it. The temperature is displayed with one fractional digit only, but there may be a few more internally. Celsius temperature will be between -30 and +50, so we can assume no more than 16 bits for it. Add some for channel, battery status and sensor id. And may be a checksum. All that will fit nicely in the 40-48 bits.
Data is sent bitwise, the method to do it may be LSB first, as it requires the least operations. So the data may be in reverse order.
The known Bresser protocols that I found documented do not match unfortunately, but the payload data has the sizes as envisioned above.
But still...

A bit of Google searching shows me the device transmits on 534 mHz, not 433mHz. And there can be up to 5 of the temp/hum sensors sending data to the central unit.

What is the id # of the one you are using. A simple deductive test would be to record the transmission, as you have done, then change to another id number and record that and continue through all 5 possibilities and then see what changes in your recording and can the change be related to an id number.

Another thing, I see the transmission period for the sensor is listed as about 47 seconds. Are you seeing that in your testing?

Paul

@Paul_KD7HB: you must be on the wrong track. I can assure you the sensor is transmitting on 433MHz. The one I have is a legacy one that is out of sales for some years already. It was never sold alone but always in combination with the weather station I mentioned in the opening post.

Miq1:
@Paul_KD7HB: you must be on the wrong track. I can assure you the sensor is transmitting on 433MHz. The one I have is a legacy one that is out of sales for some years already. It was never sold alone but always in combination with the weather station I mentioned in the opening post.

Ok, but what about the multiple units? My station is similar to yours and has dip switches to set the address of the temp/hum remote.

Paul

There are no DIP switches, on the inside there is only a reset button next to the batteries - nothing more.

Miq1:
It must be something simple - I would not expect the tiny brain of the sensor doing something elaborate.

Yes the initial flurry of bits is to settle the AGC of a receiver, you normally then have a random number of undetermined bit length that is generated when the sensor is powered.
You will obviously have temperature and humidity values, possible channel number (if your device supports this) and maybe battery condition. This may be topped of with a CRC or checksum.
I have seen different ways of doing the temperature. Some just use signed values of the temperature, multiplied to remove decimal point. Some add an offset to the temperature so (for example) -10.0C would transmit as zero, 20.0C transmits as 300.

Yes, the offset is done with other Bresser sensors as well. They even are using Fahrenheit values instead of Celsius, plus an offset of 90 degrees. I would concentrate first on the humidity, as that will be encoded as a single byte most probably.

In my Manchester lib (I know this here is PWM, not Manchester ;)) there is another technique applied: a "decoupling mask". Any data byte is first XORed with a 8-bit mask of 11001010b before being sent. May be something similar is used here, but I was not able to find one yet. I tried to XOR the bit pattern of a humidity value against the received data, apply the resulting mask (if there was one) with XOR to another message at the same spot to see if the resulting bit sequence would result into the humidity value for that second message.

But unfortunately I did not find a match in the last 16 bits - I stopped there since I did it manually and got tired noting down bits :smiley:

One more consideration: I think we can omit looking for float values, as the simplest binary form (IEEE754) will have 32 bits for a single value - too many to fit in the short message. So it will be a shorter, binary format.

I opened the sensor to look for the PCB; the sensor is a Sensirion SHTC1

It delivers temperature and humidity via I²C in 24 bit packets (MSB, LSB and Checksum). The real value is calculated as (MSB,LSB)/65536, so "10100001,00110011,00011100" gets 62.9% and "01100100,10001011,11000111" 23.7°C.

But even these bit sequences are not identifyable in the messages. 63% (displayed) would be something around "10100001,01xxxxxx" - this sequence is in fact in the sampled data ("10100001,11101001") and will result in 63.24%. But the next line had "10100000,01101001" at the same spot, that is a lower value (62,66%), while a higher (65%) was displayed.

In general the numbers at that spot are close to 62%-63%, whereas the displayed values range from 57% to 65%.

Miq1:
One more consideration: I think we can omit looking for float values, as the simplest binary form (IEEE754) will have 32 bits for a single value - too many to fit in the short message. So it will be a shorter, binary format.

I have never see floats used in these types of sensor. As mentioned in #21 the value is normally multiplied to remove the decimal point (fraction) and then divided again after reception.

Miq1:
I opened the sensor to look for the PCB; the sensor is a Sensirion SHTC1

Very unlikely the MCU in the sender would transmit raw data. The sensor info is helpful as it gives the min/max temperature & humidity ranges so we now know the temperature ranges from -30 to +100 and humidity the obvious 0-100%.
Assuming they allow for the full range then to send -30 using unsigned integers means they mast add 300 or 3000 (depending on number of decimal places the sensor works with) to the multiplied temperature.

From the image you posted in #14 I see the data as one of these...

111111111111111100111011110011000111010110100001110000110110101111
000000000000000011000100001100111000101001011110001111001001010000

but without having the temperature & humidity values it is impossible to find meaningful data.

I put the sensor in the freezer for a while and captured a good hour of data while it was warming up again. Thus I got data for negative temperatures as well now. I missed two messages around 30 minutes after beginning that were scrambled by a parallel transmission from somewhere else.

I generated two data sets, one for regular and one for inverted bits in CSV format:

17:04:59;1111111111111110011101110010010010101111010000011100011011000111;-6.0;32;
17:06:28;1111111111111110011101110011110100101111010000101100011010100111;-6.0;35;
17:07:57;1111111111111110011101110011110100101111010000010100011001000111;-3.7;47;
17:09:26;1111111111111110011101110000010001101111010000000101101010100111;-0.2;58;
17:10:55;1111111111111110011101110010110111101111010000111000101010110111;1.5;65;
17:12:24;1111111111111110011101111001010011101111010000010101001010110111;3.6;69;
17:13:53;1111111111111110011101111010010001101111010000011001001000000111;5.4;72;
17:15:22;1111111111111110011101111011010010101111010000101100001001110111;6.8;74;
17:16:51;1111111111111110011101111011100100101111010000110100001011100111;8.0;75;
17:18:20;1111111111111110011101111011110111001111010000010100001000000111;9.0;75;
17:19:49;1111111111111110011101111011110011001111010000010100001010000111;10.0;75;
17:21:18;1111111111111110011101111011110111100111010000010100001010010111;10.8;75;
17:22:47;1111111111111110011101111011100111100111010000010100001010000111;11.6;73;
17:24:16;1111111111111110011101111010010011100111010000001100001000010111;12.4;72;
17:25:45;1111111111111110011101111011010101100111010000101100001000010111;13.0;70;
17:27:14;1111111111111110011101111011110001100111010000111100001011110111;13.6;69;
17:28:43;1111111111111110011101111010010001100111010000011001001010000111;14.2;68;
17:30:12;1111111111111110011101111010110110100111010000111001001011000111;14.8;66;
17:33:10;1111111111111110011101111000110010100111010000010101001001110111;15.8;64;
17:36:08;1111111111111110011101111000110100100111010000101101001001010111;16.7;62;
17:37:37;1111111111111110011101111000010100100111010000101101001001110111;17.1;60;
17:39:06;1111111111111110011101111001110000100111010000111101001011010111;17.4;59;
17:40:35;1111111111111110011101111011010000100111010000011000101000100111;17.7;59;
17:42:04;1111111111111110011101111000010000100111010000011000101011100111;18.0;58;
17:43:33;1111111111111110011101111011110111000111010000111000101001110111;18.3;57;
17:45:02;1111111111111110011101111000110111000111010000000100101001000111;18.6;57;
17:46:31;1111111111111110011101111010010111000111010000000100101011100111;18.8;56;
17:48:00;1111111111111110011101111011100111000111010000100100101000010111;19.0;55;
17:49:29;1111111111111110011101111011110011000111010000010100101001000111;19.2;54;
17:50:58;1111111111111110011101111010110011000111010000110100101010000111;19.4;54;
17:52:27;1111111111111110011101111011010011000111010000110100101011100111;19.6;53;
17:53:56;1111111111111110011101111010010011000111010000001100101001000111;19.7;53;
17:55:25;1111111111111110011101111000010011000111010000001100101011000111;19.9;52;
17:56:54;1111111111111110011101111001100011000111010000101100101000110111;20.0;52;
17:58:23;1111111111111110011101111011110111101011010000101100101011110111;20.1;52;
17:59:52;1111111111111110011101111001110111101011010000101100101001110111;20.2;51;
18:01:21;1111111111111110011101111010110111101011010000011100101001110111;20.4;51;
18:02:50;1111111111111110011101111011010111101011010000011100101000010111;20.5;51;
18:04:19;1111111111111110011101111001010111101011010000011100101010010111;20.6;50;
18:05:48;1111111111111110011101111010010111101011010000111100101011010111;20.6;50;
18:07:17;1111111111111110011101111010010111101011010000111100101011010111;20.8;50;
18:08:46;1111111111111110011101111011100111101011010000111100101010100111;20.8;49;
18:10:15;1111111111111110011101111011100111101011010000011001101010110111;20.9;49;
18:11:44;1111111111111110011101111001100111101011010000011001101000110111;21.0;49;
18:13:13;1111111111111110011101111011110011101011010000011001101000100111;21.0;49;
18:14:42;1111111111111110011101111011110011101011010000011001101000100111;21.1;48;
18:16:11;1111111111111110011101111001110011101011010000111001101000100111;21.2;48;

And the inverted one:

17:04:59;0000000000000001100010001101101101010000101111100011100100111000;-6.0;32;
17:06:28;0000000000000001100010001100001011010000101111010011100101011000;-6.0;35;
17:07:57;0000000000000001100010001100001011010000101111101011100110111000;-3.7;47;
17:09:26;0000000000000001100010001111101110010000101111111010010101011000;-0.2;58;
17:10:55;0000000000000001100010001101001000010000101111000111010101001000;1.5;65;
17:12:24;0000000000000001100010000110101100010000101111101010110101001000;3.6;69;
17:13:53;0000000000000001100010000101101110010000101111100110110111111000;5.4;72;
17:15:22;0000000000000001100010000100101101010000101111010011110110001000;6.8;74;
17:16:51;0000000000000001100010000100011011010000101111001011110100011000;8.0;75;
17:18:20;0000000000000001100010000100001000110000101111101011110111111000;9.0;75;
17:19:49;0000000000000001100010000100001100110000101111101011110101111000;10.0;75;
17:21:18;0000000000000001100010000100001000011000101111101011110101101000;10.8;75;
17:22:47;0000000000000001100010000100011000011000101111101011110101111000;11.6;73;
17:24:16;0000000000000001100010000101101100011000101111110011110111101000;12.4;72;
17:25:45;0000000000000001100010000100101010011000101111010011110111101000;13.0;70;
17:27:14;0000000000000001100010000100001110011000101111000011110100001000;13.6;69;
17:28:43;0000000000000001100010000101101110011000101111100110110101111000;14.2;68;
17:30:12;0000000000000001100010000101001001011000101111000110110100111000;14.8;66;
17:33:10;0000000000000001100010000111001101011000101111101010110110001000;15.8;64;
17:36:08;0000000000000001100010000111001011011000101111010010110110101000;16.7;62;
17:37:37;0000000000000001100010000111101011011000101111010010110110001000;17.1;60;
17:39:06;0000000000000001100010000110001111011000101111000010110100101000;17.4;59;
17:40:35;0000000000000001100010000100101111011000101111100111010111011000;17.7;59;
17:42:04;0000000000000001100010000111101111011000101111100111010100011000;18.0;58;
17:43:33;0000000000000001100010000100001000111000101111000111010110001000;18.3;57;
17:45:02;0000000000000001100010000111001000111000101111111011010110111000;18.6;57;
17:46:31;0000000000000001100010000101101000111000101111111011010100011000;18.8;56;
17:48:00;0000000000000001100010000100011000111000101111011011010111101000;19.0;55;
17:49:29;0000000000000001100010000100001100111000101111101011010110111000;19.2;54;
17:50:58;0000000000000001100010000101001100111000101111001011010101111000;19.4;54;
17:52:27;0000000000000001100010000100101100111000101111001011010100011000;19.6;53;
17:53:56;0000000000000001100010000101101100111000101111110011010110111000;19.7;53;
17:55:25;0000000000000001100010000111101100111000101111110011010100111000;19.9;52;
17:56:54;0000000000000001100010000110011100111000101111010011010111001000;20.0;52;
17:58:23;0000000000000001100010000100001000010100101111010011010100001000;20.1;52;
17:59:52;0000000000000001100010000110001000010100101111010011010110001000;20.2;51;
18:01:21;0000000000000001100010000101001000010100101111100011010110001000;20.4;51;
18:02:50;0000000000000001100010000100101000010100101111100011010111101000;20.5;51;
18:04:19;0000000000000001100010000110101000010100101111100011010101101000;20.6;50;
18:05:48;0000000000000001100010000101101000010100101111000011010100101000;20.6;50;
18:07:17;0000000000000001100010000101101000010100101111000011010100101000;20.8;50;
18:08:46;0000000000000001100010000100011000010100101111000011010101011000;20.8;49;
18:10:15;0000000000000001100010000100011000010100101111100110010101001000;20.9;49;
18:11:44;0000000000000001100010000110011000010100101111100110010111001000;21.0;49;
18:13:13;0000000000000001100010000100001100010100101111100110010111011000;21.0;49;
18:14:42;0000000000000001100010000100001100010100101111100110010111011000;21.1;48;
18:16:11;0000000000000001100010000110001100010100101111000110010111011000;21.2;48;

I found the lines most interesting where the displayed values were identical - nevertheless the transmitted data is slightly different there. It seems the precision in the messages is higher than that displayed.

There were two regions affected when only the temperature changed, so I would take for granted there is some kind of checksum at the end of the binary data.

Once again I had to drop down the reading to make them match better with the data.

<Sync----------> <Head---> aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii <Tail <Temp       <Hum      <Bin     <Bin Inverted
0000000000000001 1000 1000 1101 1011 0101 0000 1011 1110 0011 1001 0011 1000
0000000000000001 1000 1000 1100 0010 1101 0000 1011 1101 0011 1001 0101 1000  -6.0        32 (0x20)
0000000000000001 1000 1000 1100 0010 1101 0000 1011 1110 1011 1001 1011 1000  -6.0        35 (0x23)
0000000000000001 1000 1000 1111 1011 1001 0000 1011 1111 1010 0101 0101 1000  -3.7        47 (0x2F)
0000000000000001 1000 1000 1101 0010 0001 0000 1011 1100 0111 0101 0100 1000  -0.2        58 (0x3A)
0000000000000001 1000 1000 0110 1011 0001 0000 1011 1110 1010 1101 0100 1000   1.5        65 (0x41)
0000000000000001 1000 1000 0101 1011 1001 0000 1011 1110 0110 1101 1111 1000   3.6        69 (0x45)
0000000000000001 1000 1000 0100 1011 0101 0000 1011 1101 0011 1101 1000 1000   5.4        72 (0x48)
0000000000000001 1000 1000 0100 0110 1101 0000 1011 1100 1011 1101 0001 1000   6.8        74 (0x4A)
0000000000000001 1000 1000 0100 0010 0011 0000 1011 1110 1011 1101 1111 1000   8.0        75 (0x4B)
0000000000000001 1000 1000 0100 0011 0011 0000 1011 1110 1011 1101 0111 1000   9.0        75 (0x4B)
0000000000000001 1000 1000 0100 0010 0001 1000 1011 1110 1011 1101 0110 1000  10.0        75 (0x4B)
0000000000000001 1000 1000 0100 0110 0001 1000 1011 1110 1011 1101 0111 1000  10.8        75 (0x4B)
0000000000000001 1000 1000 0101 1011 0001 1000 1011 1111 0011 1101 1110 1000  11.6        73 (0x49)
0000000000000001 1000 1000 0100 1010 1001 1000 1011 1101 0011 1101 1110 1000  12.4        72 (0x48)
0000000000000001 1000 1000 0100 0011 1001 1000 1011 1100 0011 1101 0000 1000  13.0        70 (0x46)
0000000000000001 1000 1000 0101 1011 1001 1000 1011 1110 0110 1101 0111 1000  13.6        69 (0x45)
0000000000000001 1000 1000 0101 0010 0101 1000 1011 1100 0110 1101 0011 1000  14.2        68 (0x44)
0000000000000001 1000 1000 0111 0011 0101 1000 1011 1110 1010 1101 1000 1000  14.8        66 (0x42)
0000000000000001 1000 1000 0111 0010 1101 1000 1011 1101 0010 1101 1010 1000  15.8        64 (0x40)
0000000000000001 1000 1000 0111 1010 1101 1000 1011 1101 0010 1101 1000 1000  16.7        62 (0x3E)
0000000000000001 1000 1000 0110 0011 1101 1000 1011 1100 0010 1101 0010 1000  17.1        60 (0x3C)
0000000000000001 1000 1000 0100 1011 1101 1000 1011 1110 0111 0101 1101 1000  17.4        59 (0x3B)
0000000000000001 1000 1000 0111 1011 1101 1000 1011 1110 0111 0101 0001 1000  17.7        59 (0x3B)
0000000000000001 1000 1000 0100 0010 0011 1000 1011 1100 0111 0101 1000 1000  18.0        58 (0x3A)
0000000000000001 1000 1000 0111 0010 0011 1000 1011 1111 1011 0101 1011 1000  18.3        57 (0x39)
0000000000000001 1000 1000 0101 1010 0011 1000 1011 1111 1011 0101 0001 1000  18.6        57 (0x39)
0000000000000001 1000 1000 0100 0110 0011 1000 1011 1101 1011 0101 1110 1000  18.8        56 (0x38)
0000000000000001 1000 1000 0100 0011 0011 1000 1011 1110 1011 0101 1011 1000  19.0        55 (0x37)
0000000000000001 1000 1000 0101 0011 0011 1000 1011 1100 1011 0101 0111 1000  19.2        54 (0x36)
0000000000000001 1000 1000 0100 1011 0011 1000 1011 1100 1011 0101 0001 1000  19.4        54 (0x36)
0000000000000001 1000 1000 0101 1011 0011 1000 1011 1111 0011 0101 1011 1000  19.6        53 (0x35)
0000000000000001 1000 1000 0111 1011 0011 1000 1011 1111 0011 0101 0011 1000  19.7        53 (0x35)
0000000000000001 1000 1000 0110 0111 0011 1000 1011 1101 0011 0101 1100 1000  19.9        52 (0x34)
0000000000000001 1000 1000 0100 0010 0001 0100 1011 1101 0011 0101 0000 1000  20.0        52 (0x34)
0000000000000001 1000 1000 0110 0010 0001 0100 1011 1101 0011 0101 1000 1000  20.1        52 (0x34)
0000000000000001 1000 1000 0101 0010 0001 0100 1011 1110 0011 0101 1000 1000  20.2        51 (0x33) 00110011 (11001100)
0000000000000001 1000 1000 0100 1010 0001 0100 1011 1110 0011 0101 1110 1000  20.4        51 (0x33)
0000000000000001 1000 1000 0110 1010 0001 0100 1011 1110 0011 0101 0110 1000  20.5        51 (0x33)
0000000000000001 1000 1000 0101 1010 0001 0100 1011 1100 0011 0101 0010 1000  20.6        50 (0x32)
0000000000000001 1000 1000 0101 1010 0001 0100 1011 1100 0011 0101 0010 1000  20.6        50 (0x32)
0000000000000001 1000 1000 0100 0110 0001 0100 1011 1100 0011 0101 0101 1000  20.8        50 (0x32)
0000000000000001 1000 1000 0100 0110 0001 0100 1011 1110 0110 0101 0100 1000  20.8        49 (0x31) 00110001 (11001110)
0000000000000001 1000 1000 0110 0110 0001 0100 1011 1110 0110 0101 1100 1000  20.9        49 (0x31)
0000000000000001 1000 1000 0100 0011 0001 0100 1011 1110 0110 0101 1101 1000  21.0        49 (0x31)
0000000000000001 1000 1000 0100 0011 0001 0100 1011 1110 0110 0101 1101 1000  21.0        49 (0x31)
0000000000000001 1000 1000 0110 0011 0001 0100 1011 1100 0110 0101 1101 1000  21.1        48 (0x30)
                                                                              21.2        48 (0x30)
<Sync----------> <Head---> aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii <Tail <Temp       <Hum      <Bin     <Bin Inverted

Data column ffff is definitely to do with humidity and I think eeee is probably the other part but I have not figured out the encoding yet.

dddd is related to temperature as it changes every time the temperature changes by 10 degrees (0x.x, 1x.x, 2x.x etc) It seems to be binary nibble of tens of degrees expressed in in reverse (0000 = 0x.x, 1000 = 1x.x, 0100 = 2x.x)