Go Down

Topic: [Solved] Bresser 7002000 weather station sensor decoding riddle (Read 1 time) previous topic - next topic

Riva

It does not look like Manchester but I still cannot get the data to look right.
Don't PM me for help as I will ignore it.

Miq1

It must be something simple - I would not expect the tiny brain of the sensor doing something elaborate.
The initial long-short pulses most probably will be some calibration or locking pattern for the receiver. Then the first short-long must be the start marker; perhaps even more. So the data will be in the last ~40-48 pulses.
Humidity has values between 0 and 100, so we would need 7 bits at least for it. The temperature is displayed with one fractional digit only, but there may be a few more internally. Celsius temperature will be between -30 and +50, so we can assume no more than 16 bits for it. Add some for channel, battery status and sensor id. And may be a checksum. All that will fit nicely in the 40-48 bits.
Data is sent bitwise, the method to do it may be LSB first, as it requires the least operations. So the data may be in reverse order.
The known Bresser protocols that I found documented do not match unfortunately, but the payload data has the sizes as envisioned above.
But still...

Paul_KD7HB

A bit of Google searching shows me the device transmits on 534 mHz, not 433mHz. And there can be up to 5 of the temp/hum sensors sending data to the central unit.

What is the id # of the one you are using. A simple deductive test would be to record the transmission, as you have done, then change to another id number and record that and continue through all 5 possibilities and then see what changes in your recording and can the change be related to an id number.

Another thing, I see the transmission period for the sensor is listed as about 47 seconds. Are you seeing that in your testing?

Paul

Miq1

@Paul_KD7HB: you must be on the wrong track. I can assure you the sensor is transmitting on 433MHz. The one I have is a legacy one that is out of sales for some years already. It was never sold alone but always in combination with the weather station I mentioned in the opening post.

Paul_KD7HB

@Paul_KD7HB: you must be on the wrong track. I can assure you the sensor is transmitting on 433MHz. The one I have is a legacy one that is out of sales for some years already. It was never sold alone but always in combination with the weather station I mentioned in the opening post.
Ok, but what about the multiple units? My station is similar to yours and has dip switches to set the address of the temp/hum remote.

Paul

Miq1

There are no DIP switches, on the inside there is only a reset button next to the batteries - nothing more.

Riva

It must be something simple - I would not expect the tiny brain of the sensor doing something elaborate.
Yes the initial flurry of bits is to settle the AGC of a receiver, you normally then have a random number of undetermined bit length that is generated when the sensor is powered.
You will obviously have temperature and humidity values, possible channel number (if your device supports this) and maybe battery condition. This may be topped of with a CRC or checksum.
I have seen different ways of doing the temperature. Some just use signed values of the temperature, multiplied to remove decimal point. Some add an offset to the temperature so (for example) -10.0C would transmit as zero, 20.0C transmits as 300.
Don't PM me for help as I will ignore it.

Miq1

Yes, the offset is done with other Bresser sensors as well. They even are using Fahrenheit values instead of Celsius, plus an offset of 90 degrees. I would concentrate first on the humidity, as that will be encoded as a single byte most probably.

In my Manchester lib (I know this here is PWM, not Manchester ;)) there is another technique applied: a "decoupling mask". Any data byte is first XORed with a 8-bit mask of 11001010b before being sent. May be something similar is used here, but I was not able to find one yet. I tried to XOR the bit pattern of a humidity value against the received data, apply the resulting mask (if there was one) with XOR to another message at the same spot to see if the resulting bit sequence would result into the humidity value for that second message.

But unfortunately I did not find a match in the last 16 bits - I stopped there since I did it manually and got tired noting down bits :D

Miq1

One more consideration: I think we can omit looking for float values, as the simplest binary form (IEEE754) will have 32 bits for a single value - too many to fit in the short message. So it will be a shorter, binary format.

 

Miq1

I opened the sensor to look for the PCB; the sensor is a Sensirion SHTC1

It delivers temperature and humidity via I²C in 24 bit packets (MSB, LSB and Checksum). The real value is calculated as (MSB,LSB)/65536, so "10100001,00110011,00011100" gets 62.9% and "01100100,10001011,11000111" 23.7°C.

But even these bit sequences are not identifyable in the messages. 63% (displayed) would be something around "10100001,01xxxxxx" - this sequence is in fact in the sampled data ("10100001,11101001") and will result in 63.24%. But the next line had "10100000,01101001" at the same spot, that is a lower value (62,66%), while a higher (65%) was displayed.

In general the numbers at that spot are close to 62%-63%, whereas the displayed values range from 57% to 65%.

Riva

One more consideration: I think we can omit looking for float values, as the simplest binary form (IEEE754) will have 32 bits for a single value - too many to fit in the short message. So it will be a shorter, binary format.
I have never see floats used in these types of sensor. As mentioned in #21 the value is normally multiplied to remove the decimal point (fraction) and then divided again after reception.
Don't PM me for help as I will ignore it.

Riva

I opened the sensor to look for the PCB; the sensor is a Sensirion SHTC1
Very unlikely the MCU in the sender would transmit raw data. The sensor info is helpful as it gives the min/max temperature & humidity ranges so we now know the temperature ranges from -30 to +100 and humidity the obvious 0-100%.
Assuming they allow for the full range then to send -30 using unsigned integers means they mast add 300 or 3000 (depending on number of decimal places the sensor works with) to the multiplied temperature.

From the image you posted in #14 I see the data as one of these...
Code: [Select]
111111111111111100111011110011000111010110100001110000110110101111
000000000000000011000100001100111000101001011110001111001001010000

but without having the temperature & humidity values it is impossible to find meaningful data.
Don't PM me for help as I will ignore it.

Miq1

I put the sensor in the freezer for a while and captured a good hour of data while it was warming up again. Thus I got data for negative temperatures as well now. I missed two messages around 30 minutes after beginning that were scrambled by a parallel transmission from somewhere else.

I generated two data sets, one for regular and one for inverted bits in CSV format:
Code: [Select]

17:04:59;1111111111111110011101110010010010101111010000011100011011000111;-6.0;32;
17:06:28;1111111111111110011101110011110100101111010000101100011010100111;-6.0;35;
17:07:57;1111111111111110011101110011110100101111010000010100011001000111;-3.7;47;
17:09:26;1111111111111110011101110000010001101111010000000101101010100111;-0.2;58;
17:10:55;1111111111111110011101110010110111101111010000111000101010110111;1.5;65;
17:12:24;1111111111111110011101111001010011101111010000010101001010110111;3.6;69;
17:13:53;1111111111111110011101111010010001101111010000011001001000000111;5.4;72;
17:15:22;1111111111111110011101111011010010101111010000101100001001110111;6.8;74;
17:16:51;1111111111111110011101111011100100101111010000110100001011100111;8.0;75;
17:18:20;1111111111111110011101111011110111001111010000010100001000000111;9.0;75;
17:19:49;1111111111111110011101111011110011001111010000010100001010000111;10.0;75;
17:21:18;1111111111111110011101111011110111100111010000010100001010010111;10.8;75;
17:22:47;1111111111111110011101111011100111100111010000010100001010000111;11.6;73;
17:24:16;1111111111111110011101111010010011100111010000001100001000010111;12.4;72;
17:25:45;1111111111111110011101111011010101100111010000101100001000010111;13.0;70;
17:27:14;1111111111111110011101111011110001100111010000111100001011110111;13.6;69;
17:28:43;1111111111111110011101111010010001100111010000011001001010000111;14.2;68;
17:30:12;1111111111111110011101111010110110100111010000111001001011000111;14.8;66;
17:33:10;1111111111111110011101111000110010100111010000010101001001110111;15.8;64;
17:36:08;1111111111111110011101111000110100100111010000101101001001010111;16.7;62;
17:37:37;1111111111111110011101111000010100100111010000101101001001110111;17.1;60;
17:39:06;1111111111111110011101111001110000100111010000111101001011010111;17.4;59;
17:40:35;1111111111111110011101111011010000100111010000011000101000100111;17.7;59;
17:42:04;1111111111111110011101111000010000100111010000011000101011100111;18.0;58;
17:43:33;1111111111111110011101111011110111000111010000111000101001110111;18.3;57;
17:45:02;1111111111111110011101111000110111000111010000000100101001000111;18.6;57;
17:46:31;1111111111111110011101111010010111000111010000000100101011100111;18.8;56;
17:48:00;1111111111111110011101111011100111000111010000100100101000010111;19.0;55;
17:49:29;1111111111111110011101111011110011000111010000010100101001000111;19.2;54;
17:50:58;1111111111111110011101111010110011000111010000110100101010000111;19.4;54;
17:52:27;1111111111111110011101111011010011000111010000110100101011100111;19.6;53;
17:53:56;1111111111111110011101111010010011000111010000001100101001000111;19.7;53;
17:55:25;1111111111111110011101111000010011000111010000001100101011000111;19.9;52;
17:56:54;1111111111111110011101111001100011000111010000101100101000110111;20.0;52;
17:58:23;1111111111111110011101111011110111101011010000101100101011110111;20.1;52;
17:59:52;1111111111111110011101111001110111101011010000101100101001110111;20.2;51;
18:01:21;1111111111111110011101111010110111101011010000011100101001110111;20.4;51;
18:02:50;1111111111111110011101111011010111101011010000011100101000010111;20.5;51;
18:04:19;1111111111111110011101111001010111101011010000011100101010010111;20.6;50;
18:05:48;1111111111111110011101111010010111101011010000111100101011010111;20.6;50;
18:07:17;1111111111111110011101111010010111101011010000111100101011010111;20.8;50;
18:08:46;1111111111111110011101111011100111101011010000111100101010100111;20.8;49;
18:10:15;1111111111111110011101111011100111101011010000011001101010110111;20.9;49;
18:11:44;1111111111111110011101111001100111101011010000011001101000110111;21.0;49;
18:13:13;1111111111111110011101111011110011101011010000011001101000100111;21.0;49;
18:14:42;1111111111111110011101111011110011101011010000011001101000100111;21.1;48;
18:16:11;1111111111111110011101111001110011101011010000111001101000100111;21.2;48;


And the inverted one:
Code: [Select]

17:04:59;0000000000000001100010001101101101010000101111100011100100111000;-6.0;32;
17:06:28;0000000000000001100010001100001011010000101111010011100101011000;-6.0;35;
17:07:57;0000000000000001100010001100001011010000101111101011100110111000;-3.7;47;
17:09:26;0000000000000001100010001111101110010000101111111010010101011000;-0.2;58;
17:10:55;0000000000000001100010001101001000010000101111000111010101001000;1.5;65;
17:12:24;0000000000000001100010000110101100010000101111101010110101001000;3.6;69;
17:13:53;0000000000000001100010000101101110010000101111100110110111111000;5.4;72;
17:15:22;0000000000000001100010000100101101010000101111010011110110001000;6.8;74;
17:16:51;0000000000000001100010000100011011010000101111001011110100011000;8.0;75;
17:18:20;0000000000000001100010000100001000110000101111101011110111111000;9.0;75;
17:19:49;0000000000000001100010000100001100110000101111101011110101111000;10.0;75;
17:21:18;0000000000000001100010000100001000011000101111101011110101101000;10.8;75;
17:22:47;0000000000000001100010000100011000011000101111101011110101111000;11.6;73;
17:24:16;0000000000000001100010000101101100011000101111110011110111101000;12.4;72;
17:25:45;0000000000000001100010000100101010011000101111010011110111101000;13.0;70;
17:27:14;0000000000000001100010000100001110011000101111000011110100001000;13.6;69;
17:28:43;0000000000000001100010000101101110011000101111100110110101111000;14.2;68;
17:30:12;0000000000000001100010000101001001011000101111000110110100111000;14.8;66;
17:33:10;0000000000000001100010000111001101011000101111101010110110001000;15.8;64;
17:36:08;0000000000000001100010000111001011011000101111010010110110101000;16.7;62;
17:37:37;0000000000000001100010000111101011011000101111010010110110001000;17.1;60;
17:39:06;0000000000000001100010000110001111011000101111000010110100101000;17.4;59;
17:40:35;0000000000000001100010000100101111011000101111100111010111011000;17.7;59;
17:42:04;0000000000000001100010000111101111011000101111100111010100011000;18.0;58;
17:43:33;0000000000000001100010000100001000111000101111000111010110001000;18.3;57;
17:45:02;0000000000000001100010000111001000111000101111111011010110111000;18.6;57;
17:46:31;0000000000000001100010000101101000111000101111111011010100011000;18.8;56;
17:48:00;0000000000000001100010000100011000111000101111011011010111101000;19.0;55;
17:49:29;0000000000000001100010000100001100111000101111101011010110111000;19.2;54;
17:50:58;0000000000000001100010000101001100111000101111001011010101111000;19.4;54;
17:52:27;0000000000000001100010000100101100111000101111001011010100011000;19.6;53;
17:53:56;0000000000000001100010000101101100111000101111110011010110111000;19.7;53;
17:55:25;0000000000000001100010000111101100111000101111110011010100111000;19.9;52;
17:56:54;0000000000000001100010000110011100111000101111010011010111001000;20.0;52;
17:58:23;0000000000000001100010000100001000010100101111010011010100001000;20.1;52;
17:59:52;0000000000000001100010000110001000010100101111010011010110001000;20.2;51;
18:01:21;0000000000000001100010000101001000010100101111100011010110001000;20.4;51;
18:02:50;0000000000000001100010000100101000010100101111100011010111101000;20.5;51;
18:04:19;0000000000000001100010000110101000010100101111100011010101101000;20.6;50;
18:05:48;0000000000000001100010000101101000010100101111000011010100101000;20.6;50;
18:07:17;0000000000000001100010000101101000010100101111000011010100101000;20.8;50;
18:08:46;0000000000000001100010000100011000010100101111000011010101011000;20.8;49;
18:10:15;0000000000000001100010000100011000010100101111100110010101001000;20.9;49;
18:11:44;0000000000000001100010000110011000010100101111100110010111001000;21.0;49;
18:13:13;0000000000000001100010000100001100010100101111100110010111011000;21.0;49;
18:14:42;0000000000000001100010000100001100010100101111100110010111011000;21.1;48;
18:16:11;0000000000000001100010000110001100010100101111000110010111011000;21.2;48;


I found the lines most interesting where the displayed values were identical - nevertheless the transmitted data is slightly different there. It seems the precision in the messages is higher than that displayed.

There were two regions affected when only the temperature changed, so I would take for granted there is some kind of checksum at the end of the binary data.

Riva

Once again I had to drop down the reading to make them match better with the data.

Code: [Select]
<Sync----------> <Head---> aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii <Tail <Temp       <Hum      <Bin     <Bin Inverted
0000000000000001 1000 1000 1101 1011 0101 0000 1011 1110 0011 1001 0011 1000
0000000000000001 1000 1000 1100 0010 1101 0000 1011 1101 0011 1001 0101 1000  -6.0        32 (0x20)
0000000000000001 1000 1000 1100 0010 1101 0000 1011 1110 1011 1001 1011 1000  -6.0        35 (0x23)
0000000000000001 1000 1000 1111 1011 1001 0000 1011 1111 1010 0101 0101 1000  -3.7        47 (0x2F)
0000000000000001 1000 1000 1101 0010 0001 0000 1011 1100 0111 0101 0100 1000  -0.2        58 (0x3A)
0000000000000001 1000 1000 0110 1011 0001 0000 1011 1110 1010 1101 0100 1000   1.5        65 (0x41)
0000000000000001 1000 1000 0101 1011 1001 0000 1011 1110 0110 1101 1111 1000   3.6        69 (0x45)
0000000000000001 1000 1000 0100 1011 0101 0000 1011 1101 0011 1101 1000 1000   5.4        72 (0x48)
0000000000000001 1000 1000 0100 0110 1101 0000 1011 1100 1011 1101 0001 1000   6.8        74 (0x4A)
0000000000000001 1000 1000 0100 0010 0011 0000 1011 1110 1011 1101 1111 1000   8.0        75 (0x4B)
0000000000000001 1000 1000 0100 0011 0011 0000 1011 1110 1011 1101 0111 1000   9.0        75 (0x4B)
0000000000000001 1000 1000 0100 0010 0001 1000 1011 1110 1011 1101 0110 1000  10.0        75 (0x4B)
0000000000000001 1000 1000 0100 0110 0001 1000 1011 1110 1011 1101 0111 1000  10.8        75 (0x4B)
0000000000000001 1000 1000 0101 1011 0001 1000 1011 1111 0011 1101 1110 1000  11.6        73 (0x49)
0000000000000001 1000 1000 0100 1010 1001 1000 1011 1101 0011 1101 1110 1000  12.4        72 (0x48)
0000000000000001 1000 1000 0100 0011 1001 1000 1011 1100 0011 1101 0000 1000  13.0        70 (0x46)
0000000000000001 1000 1000 0101 1011 1001 1000 1011 1110 0110 1101 0111 1000  13.6        69 (0x45)
0000000000000001 1000 1000 0101 0010 0101 1000 1011 1100 0110 1101 0011 1000  14.2        68 (0x44)
0000000000000001 1000 1000 0111 0011 0101 1000 1011 1110 1010 1101 1000 1000  14.8        66 (0x42)
0000000000000001 1000 1000 0111 0010 1101 1000 1011 1101 0010 1101 1010 1000  15.8        64 (0x40)
0000000000000001 1000 1000 0111 1010 1101 1000 1011 1101 0010 1101 1000 1000  16.7        62 (0x3E)
0000000000000001 1000 1000 0110 0011 1101 1000 1011 1100 0010 1101 0010 1000  17.1        60 (0x3C)
0000000000000001 1000 1000 0100 1011 1101 1000 1011 1110 0111 0101 1101 1000  17.4        59 (0x3B)
0000000000000001 1000 1000 0111 1011 1101 1000 1011 1110 0111 0101 0001 1000  17.7        59 (0x3B)
0000000000000001 1000 1000 0100 0010 0011 1000 1011 1100 0111 0101 1000 1000  18.0        58 (0x3A)
0000000000000001 1000 1000 0111 0010 0011 1000 1011 1111 1011 0101 1011 1000  18.3        57 (0x39)
0000000000000001 1000 1000 0101 1010 0011 1000 1011 1111 1011 0101 0001 1000  18.6        57 (0x39)
0000000000000001 1000 1000 0100 0110 0011 1000 1011 1101 1011 0101 1110 1000  18.8        56 (0x38)
0000000000000001 1000 1000 0100 0011 0011 1000 1011 1110 1011 0101 1011 1000  19.0        55 (0x37)
0000000000000001 1000 1000 0101 0011 0011 1000 1011 1100 1011 0101 0111 1000  19.2        54 (0x36)
0000000000000001 1000 1000 0100 1011 0011 1000 1011 1100 1011 0101 0001 1000  19.4        54 (0x36)
0000000000000001 1000 1000 0101 1011 0011 1000 1011 1111 0011 0101 1011 1000  19.6        53 (0x35)
0000000000000001 1000 1000 0111 1011 0011 1000 1011 1111 0011 0101 0011 1000  19.7        53 (0x35)
0000000000000001 1000 1000 0110 0111 0011 1000 1011 1101 0011 0101 1100 1000  19.9        52 (0x34)
0000000000000001 1000 1000 0100 0010 0001 0100 1011 1101 0011 0101 0000 1000  20.0        52 (0x34)
0000000000000001 1000 1000 0110 0010 0001 0100 1011 1101 0011 0101 1000 1000  20.1        52 (0x34)
0000000000000001 1000 1000 0101 0010 0001 0100 1011 1110 0011 0101 1000 1000  20.2        51 (0x33) 00110011 (11001100)
0000000000000001 1000 1000 0100 1010 0001 0100 1011 1110 0011 0101 1110 1000  20.4        51 (0x33)
0000000000000001 1000 1000 0110 1010 0001 0100 1011 1110 0011 0101 0110 1000  20.5        51 (0x33)
0000000000000001 1000 1000 0101 1010 0001 0100 1011 1100 0011 0101 0010 1000  20.6        50 (0x32)
0000000000000001 1000 1000 0101 1010 0001 0100 1011 1100 0011 0101 0010 1000  20.6        50 (0x32)
0000000000000001 1000 1000 0100 0110 0001 0100 1011 1100 0011 0101 0101 1000  20.8        50 (0x32)
0000000000000001 1000 1000 0100 0110 0001 0100 1011 1110 0110 0101 0100 1000  20.8        49 (0x31) 00110001 (11001110)
0000000000000001 1000 1000 0110 0110 0001 0100 1011 1110 0110 0101 1100 1000  20.9        49 (0x31)
0000000000000001 1000 1000 0100 0011 0001 0100 1011 1110 0110 0101 1101 1000  21.0        49 (0x31)
0000000000000001 1000 1000 0100 0011 0001 0100 1011 1110 0110 0101 1101 1000  21.0        49 (0x31)
0000000000000001 1000 1000 0110 0011 0001 0100 1011 1100 0110 0101 1101 1000  21.1        48 (0x30)
                                                                              21.2        48 (0x30)
<Sync----------> <Head---> aaaa bbbb cccc dddd eeee ffff gggg hhhh iiii <Tail <Temp       <Hum      <Bin     <Bin Inverted


Data column ffff is definitely to do with humidity and I think eeee is probably the other part but I have not figured out the encoding yet.

dddd is related to temperature as it changes every time the temperature changes by 10 degrees (0x.x, 1x.x, 2x.x etc) It seems to be binary nibble of tens of degrees expressed in in reverse (0000 = 0x.x, 1000 = 1x.x, 0100 = 2x.x)

Don't PM me for help as I will ignore it.

Miq1

Ah, wonderful! Although it sounds strange it seems as if the data transmitted really is sent before a new measurement is taken. Who would design such a thing? :o

If the encoding is similar to other Bresser codes I saw, hhhh and iiii will be the checksum, ffff and gggg humidity, bbbb to eeee temperature  and the second part of <Head> plus aaaa the device ID plus battery status flags.

Go Up