Reverse engineering wireless weather stations

lacrosse_wireless_temp_sensor

[Fred] got a La Crosse wireless weather station as a gift and thought the LCD display was great, but he was dismayed that there was no means of extracting the temperature data for use on a computer. He thought that the modular design of the system would make it great for use in his home automation project if he could only get his hands on the data.

He tore into the base station and started looking around for easy places to get at the data he was looking for. He thought about tapping into the bus that controls the LCD in hopes of finding an easy to decode signal, but the weather station used a proprietary chip with an integrated LCD controller, making it all but impossible. Instead, he started sniffing the data coming across the wireless link, and while he didn’t quite yet know what he was seeing, it was a start.

He sniffed the signals using Audacity, and eventually found that the base station received 40-bit data bursts from each sensor. He dug further, and with the help of some data he found online, he was able to decode the data packets. The last hurdle he ran into was figuring out how the system’s CRC encoding worked. It took a bit of work but he eventually got it, and can now record data packets knowing that the data has come over the air intact.

So far, it looks like his temperature monitoring system is working quite well, though he has several improvements planned for the near future. If you have a similar unit and are interested in extending its capabilities, [Fred] has posted plenty of code on his site.

Comments

  1. giacomo says:

    Nice work reversing that CRC. It might be interesting to try the reverse hack – build/repurpose a transmitter to send arbitrary temp readings to the base station. You could use it to, say, monitor the temps of a distant server room, or temperature readings for some other part of the world (sourced from the Web, of course).

  2. peet says:

    nice hack!

    what do you guess?
    do other stations work with the same protocol?

    few weeks ago, i wanted to change the barometric sensor of a WS against a CO2 sensor.

    my intention was to provide a analog signal and faking the barometric sensor, but it didnt work since it was all proprietery.

  3. DeKay says:

    I’ve done something similar with the Davis weather stations. My blog shows how to interface a PC to the console for about $15 rather than using the $150 dongle from Davis. I’ve also sniffed the console’s wireless receiver chip configuration so that I’ll be able to (eventually) receive the data on an IM-ME.

    http://madscientistlabs.blogspot.com/search/label/Davis%20VP2

    I also expect that I could add data logger capabilities to my DIY interface for around $1. Haven’t gotten to this yet because, unfortunately, my time for hacking this thing in the summertime is almost non-existent.
    http://www.wxforum.net/index.php?topic=11675.25

  4. redwire says:

    I wish he gave the baud rate- it prob. is NRZ encoded and might work with 433MHz National Geographic/Thermo protocol

  5. wulfman says:

    Audacity: Free Audio Editor and Recorder

    So he used a audio program to sniff the wireless data ?

    I am confused

  6. tjb says:

    I have used Audacity to look a signals too. It is kind of like a storage scope with out the calibrated voltage.

  7. imp999 says:

    r u sayin a regular sound card can detect minute 2.4 ghz fluctuations? wtf? what if u hooked a transmitter to the headphone jack? could it transmit too?

  8. Mike Nathan says:

    There seems to be a bit of confusion regarding the use of Audacity in this project.

    As he mentions in his writeup, Fred tapped in to the data and clock lines of the wireless chip on the receiver. This gives him full access to all of the same signals the receiver is getting from the remote unit. Audacity can be used as a “poor man’s spectrum analyzer” to look more closely at the data as demonstrated in several projects we have featured in the past.

  9. moldboy says:

    except he is using audacity as an oscilloscope not a spectrum analyser. It isn’t looking at the wireless signal, rather the data from the wireless receiver.

  10. I’ve looked at several basic wireless protocols at 432.92 MHz (all using simple ON-OFF keying with a proprietary encoding), including a no-name wireless thermometer: http://bertrik.sikken.nl/433mhz/
    Used audacity for recording the waveforms as well :)

  11. Erik says:

    Audacity can be used to measure the low frequency signals. However be aware that the sound card is supposed to work with low frequencies (audio) so this will of course not work with high frequency signals because the sample rate is too low.

  12. Roel says:

    That was an inspiring read, nice!

  13. Alessandro says:

    To whom it may concern (could not find project developer’s Email address):
    Humidity/Temp sensor looks pretty much an SHT11 from Sensirion. FWIW. Alessandro

  14. fredboboss says:

    thank you for the nice comments and the suggestions. !

    I used Audacity and my PC soundcard as a low cost oscilloscope.
    It works for low frequency signals that are less than a few kHz.
    I sniffed what the receiver sub-module outputs to the controller, that is after demodulation.
    There the clock and the data seem at 19.2 kHz, which the soundcard can easily record.
    I used 96kHz as a sampling rate to record the data.

    Thank you also for sharing links to similar projects, they are a useful source of information !

  15. Rinie says:

    The IT+ protocol uses FSK, see decoding with RFM12B at http://forum.jeelabs.net/comment/3658#comment-3658

  16. Bill says:

    Is there a way to track for a stolen temp sending unit? I live in South Florida and continue to get readings. Think a neighbor took it. It must be in someones house since the readings a consistent arournd 78 degrees , 12 below the outside temp
    I have a 432 mc ham handi- talke but am not aaaable to pick up a data burst Any ideas
    Thanks
    Bill

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 92,028 other followers