[Fred] got a La Crosse wireless weather station as a gift and thought the LCD display was great, but he was dismayed that there was no means of extracting the temperature data for use on a computer. He thought that the modular design of the system would make it great for use in his home automation project if he could only get his hands on the data.
He tore into the base station and started looking around for easy places to get at the data he was looking for. He thought about tapping into the bus that controls the LCD in hopes of finding an easy to decode signal, but the weather station used a proprietary chip with an integrated LCD controller, making it all but impossible. Instead, he started sniffing the data coming across the wireless link, and while he didn’t quite yet know what he was seeing, it was a start.
He sniffed the signals using Audacity, and eventually found that the base station received 40-bit data bursts from each sensor. He dug further, and with the help of some data he found online, he was able to decode the data packets. The last hurdle he ran into was figuring out how the system’s CRC encoding worked. It took a bit of work but he eventually got it, and can now record data packets knowing that the data has come over the air intact.
So far, it looks like his temperature monitoring system is working quite well, though he has several improvements planned for the near future. If you have a similar unit and are interested in extending its capabilities, [Fred] has posted plenty of code on his site.
Subscribe for weekly videos
Nice work reversing that CRC. It might be interesting to try the reverse hack – build/repurpose a transmitter to send arbitrary temp readings to the base station. You could use it to, say, monitor the temps of a distant server room, or temperature readings for some other part of the world (sourced from the Web, of course).
nice hack!
what do you guess?
do other stations work with the same protocol?
few weeks ago, i wanted to change the barometric sensor of a WS against a CO2 sensor.
my intention was to provide a analog signal and faking the barometric sensor, but it didnt work since it was all proprietery.
I’ve done something similar with the Davis weather stations. My blog shows how to interface a PC to the console for about $15 rather than using the $150 dongle from Davis. I’ve also sniffed the console’s wireless receiver chip configuration so that I’ll be able to (eventually) receive the data on an IM-ME.
http://madscientistlabs.blogspot.com/search/label/Davis%20VP2
I also expect that I could add data logger capabilities to my DIY interface for around $1. Haven’t gotten to this yet because, unfortunately, my time for hacking this thing in the summertime is almost non-existent.
http://www.wxforum.net/index.php?topic=11675.25
I wish he gave the baud rate- it prob. is NRZ encoded and might work with 433MHz National Geographic/Thermo protocol
Audacity: Free Audio Editor and Recorder
So he used a audio program to sniff the wireless data ?
I am confused
I have used Audacity to look a signals too. It is kind of like a storage scope with out the calibrated voltage.
r u sayin a regular sound card can detect minute 2.4 ghz fluctuations? wtf? what if u hooked a transmitter to the headphone jack? could it transmit too?
There seems to be a bit of confusion regarding the use of Audacity in this project.
As he mentions in his writeup, Fred tapped in to the data and clock lines of the wireless chip on the receiver. This gives him full access to all of the same signals the receiver is getting from the remote unit. Audacity can be used as a “poor man’s spectrum analyzer” to look more closely at the data as demonstrated in several projects we have featured in the past.
except he is using audacity as an oscilloscope not a spectrum analyser. It isn’t looking at the wireless signal, rather the data from the wireless receiver.
I’ve looked at several basic wireless protocols at 432.92 MHz (all using simple ON-OFF keying with a proprietary encoding), including a no-name wireless thermometer: http://bertrik.sikken.nl/433mhz/
Used audacity for recording the waveforms as well :)
Audacity can be used to measure the low frequency signals. However be aware that the sound card is supposed to work with low frequencies (audio) so this will of course not work with high frequency signals because the sample rate is too low.
That was an inspiring read, nice!
To whom it may concern (could not find project developer’s Email address):
Humidity/Temp sensor looks pretty much an SHT11 from Sensirion. FWIW. Alessandro
thank you for the nice comments and the suggestions. !
I used Audacity and my PC soundcard as a low cost oscilloscope.
It works for low frequency signals that are less than a few kHz.
I sniffed what the receiver sub-module outputs to the controller, that is after demodulation.
There the clock and the data seem at 19.2 kHz, which the soundcard can easily record.
I used 96kHz as a sampling rate to record the data.
Thank you also for sharing links to similar projects, they are a useful source of information !
The IT+ protocol uses FSK, see decoding with RFM12B at http://forum.jeelabs.net/comment/3658#comment-3658