Yet Another cracked external weather temperature sensor on 433MHz (4-LD2289-5)

Hello Everyone!

I’m here to share my recent voyage with external weather sensor for SilverCrest Weather station purchased in UK’s Lidl. As far as I can see it only reads temperature and send it to Station via 433Mhz radio signal. Small tip here: the frequency is not solid (cheap RF transmitter, battery getting weaker??, dunno), when temperature dropped, frequency moved to the left of 433MHz spectrum few KHz.

Anyway, it has been described before how to use sound card and voltage divider to create pretty good sampler. I did it as well initially, but then I’ve purchased cheap logic analyser for £9.79 (24MHz sampling max, x8 channels) and I have to say it was really good to see signal in 1 and 0, plus it has simple i2c, Manchester, SPI, serial, CAN decoders and this can be very useful. No voltage divider necessary, connection straight to DATA pin (0-5V compatible) of RF receiver.

Third method I’ve chosen is actually quite (more) complicated, but it was the most universal for me, especially that I didn’t know anything about probed signal and I want to know if there is anything else in the air. I used SDR# and RTL DVB USB stick. I’ve been playing with it for few days and it’s very absorbing…

So, first of all, we need to record sequence from that sensor and actually having one is great because you can press “reset” at the back and sensor will send another sequence. Other wise you need to wait until it will send it. It can take anything from 20sec (new batteries) to 5 minutes (why?).
Using SDRSharp, we can record 16 bit WAV by pressing Record in Recording on the left side of the screen, don’t forget to mark “baseband” only, then in Audacity cut fragment with signal only, make MONO (you don’t need stereo), AMPLIFY to “new Peak Amplitude = 0.0” and repeat process with new sample IMPORTed as new track to Audacity. Just be aware that 1 minute is around 1GB of data in 16bit WAV. BTW: If you discover that signal is very tinny just increase RF Gain, but not too much at the time, measured ping signal must be max 0 dB in FFT windows in SDR#.

By now you should have few tracks to decoding. The signal is repeated 3 times, but I cut out only middle one, so in my Audacity windows you can see 15 different samples, but each need to be repeated 3 times (most of them repeating signals from 3 to 10 times to make sure receiver will get it).
Ok, so time to decode signal: if you look carefully, you will see that (and this is power of SDR# method) visually there are only 2 different signals: short ping and pause or 3x short ping. So, lets count all pings. In first sample is 46, but forth has 42 and other differ as well, so no go. Time wise same situation... They just finish at different times. Lets try substitute those threes in to "1" and single ping into "0"... Now we have something: the first 8 pings is just start transmission marker, so leave it. Last 2 close pings are always there (if there is beginning then there must be the end of transmission), so we are leaving them alone as well.
So, If you count now there is 28bits in first, second and all the other samples.

sensor on my desk
here in the freezer
on top of my computer
back to freezer

If you take last 8 bits and convert them it will come with crazy readings, so lets say 16 bits = 0001011100001010 (first sample) and we have DECimal 5898... Rubbish... Lets try HEXadecimal: 170A. EEEErrrr??? Next sample let say from fridge after 30 minutes: 0010001000011111 DEC: 8735, HEX: 221F... Can you see it? 22.1 centigrade, but where is minus? 2 bits before! if you look at them all you will see that 11 bit from left was 1 when in fridge and 0 when not. So, there is out temperature -22.1
Let's see table again:

sensor on my desk
000011000000 0001011100001010 170A 17.0
000011000000 0001001000111100 123C 12.3
000011000000 0000100110011100 99C 9.9
here in the freezer
000011000010 0000000000101100 2C - 2.0
000011000010 0000011101001101 74D - 7.4
000011000010 0001000010000111 1087 -10.8
on top of my computer
000011000000 0010001000111111 223F 22.3
000011000000 0010011000111011 263B 26.3
000011000000 0010100100100101 2925 29.2
000011000000 0011001000001101 320D 32.0
000011000000 0011001000111110 323E 32.3
000011000000 0011000100101100 312C 31.2
back to freezer
000011000010 0010000101111010 217A -21.7
000011000010 0010000100001101 210D -21.0
000011000010 0010001000011111 221F -22.1

I think this sensor is cracked, unless I made mistake somewhere...