RF transmission protocol

of Auriol H13726 Ventus WS155, Hama EWS 1500, Meteoscan W155/W160 wireless weather stations v2.0
by TFD www.tfd.hu tfd@tfd.hu 2011. January 25.

1 RF transmission

1.1 Modulation and bit timing
The data from the sensors is transmitted on 433.92 MHz with OOK (on/off keying) modulation. The bits are coded by the duration of the off keying intervals between the ~0.5 msec on keying pulses as follows: - sync bit - 1 data bit - 0 data bit ~9 msec, ~4 msec, ~2 msec.
Note, that timings are approximates, they depend on the receiver characteristic.

1.2 Transmission bursts

The transmissions take place in bursts. One burst consist of some sync bit separated data packets, that contain 36 data bits each. These bursts are then repeated in specified time intervals. The two sensors have a slightly different burst format, more on that later.

1.3 Samples

For better understanding the physical layer of the protocol here are some samples captured with a logic analyzer:
Combined sensor: transmission burst
Combined sensor: first packet of the burst above
Combined sensor: bit timing
Rain gauge: transmission burst
Rain gauge: first packet of the burst above

Rain gauge: bit timing

1.4 General packet format
Each data packet contains 36 bits, that form bit (LSB first) nibbles namely n 0 to n8. The first two and the last nibbles have the same meaning for each type of packets, the others carry the sensor specific payload data. nrrrrrr5 nrr7 v payload 8 n2 n3 n4 n5 n6 n7 n8 c0 c1 c2 c3 checksum

random id - random id

At power up (when the batteries are inserted) the sensor selects a random number, that will use as a (hopefully) unique identifier to avoid interference with similar sensors in the base unit's receiving range. After collecting a lot of random ids it seems, that r4 is always 0, the others are truly randoms. 0: Sensor's battery voltage is normal. 1: Battery voltage is below ~2.6 V. This field is used to validate the data integrity of a packet. The two sensors use different formulas to compute this field, see the details there.

-v - checksum

2 Combined sensor
2.1 Transmission schedule
The combined sensor sends all of it's data in the following burst format: - bits preamble to prepare the receiver circuitry, - 1 sync bit, - 36 bits data packets repeated 6 times, 4 sync bits between each packet, - 1 sync bit. Typical transmitting period is 31 seconds.
2.2 Temperature and relative humidity data
This packet is repeated six times within a transmission burst. Only one of six consecutive transmission bursts contains this type of data. nrrrrrr5 nrr7 v 8 n2 x0 x1 X bt. t0 t1 n3 t2 t3 t4 t5 n4 t6 t7 t8 n5 n6 n7 n8
35 t9 t10 t11 ho0 ho1 ho2 ho3 ht0 ht1 ht2 ht3 c0 c1 c2 c3 rh ones rh tens checksum temperature [0.1 C]
random id - temperature - rh ones, rh tens
This 12 bits wide 2's complement signed binary number represents the actual temperature value in 0.1 C units. Two BCD digits, that shows the actual relative humidity in %.
0: Scheduled transmission. 1: The transmission was initiated by pressing the button inside the sensor unit. x1 x1 Valid temperature/humidity data was seen with all of these three values. Their meaning is unknown. Non temperature/humidity data. All other type data packets have this value in this field.

- checksum

The formula is used in all types of packets sent by the combined sensor: n8 = ( 0xf - n0 - n1 - n2 - n3 - n4 - n5 - n6 - n7 ) & 0xf
2.3 Wind speed and direction data
These two packets are sent in pairs repeated three times within a transmission burst. Five of six consecutive transmission bursts contain this type of data. nrrrrrr5 nrr7 v nrrrrrr7 v n2 x0 xn2 x0 x1 bt. bt. n0 n0 n0 n3 n4 n5 s0 s1 n6 s2 s3 s4 s5 n7 s6 n8 s7 c0 c1 c2 c3 checksum n8
35 average wind speed [0.2 m/s] n6 n7

random id nrr1

35 d0 d1 d2 d3 d4 d5 d6 d7 d8 g0 g1 g2 g3 g4 g5 g6 g7 c0 c1 c2 c3 wind direction [] 7 wind gust [0.2 m/s] checksum

random id

- average wind speed, wind gust - wind direction
Both fields are a 8 bits wide unsigned binary numbers, that describe the corresponding wind speed values in 0.2 m/s units. This 9 bits wide unsigned binary number shows the wind direction in degrees. Only these values were seen: 0 (N), 45 (NE), 90 (E), 135 (SE), 180 (S), 225 (SW), 270 (W), 315 (NW). Other values - that are sometimes shown on the base unit's LCD screen - seems to be interpolated animations only. 0: scheduled transmission. 1: the transmission was initiated by pressing the button inside the sensor unit.

3 Rain gauge

3.1 Transmission schedule
The rain gauge's burst format: - bit preamble to prepare the receiver circuitry, - 1 sync bit, - 36 bits data packets repeated 7 times, 1 sync bit between each packet, - 1 sync bit. Typical transmitting period is 2 minutes 28 seconds, that may be shorter if there is a change in the measured value.

3.2 Rain data

Each 7 packet in a burst contain the same data. nrrrrrr5 nrr7 v 8 n2 x0 xn3 r0 r1 n4 r2 r3 r4 r5 n5 r6 r7 r8 n6 n7 n8
35 r9 r10 r11 r12 r13 r14 r15 c0 c1 c2 c3 checksum rain [0.25 mm]

random id - rain

This 16 bits wide unsigned binary number represents the accumulated (since power on) rain data in 0.25 mm units. Usually each tipping of a bucket means 0.5 mm, that causes this number incremented by 2, but in some cases the least significant bit is also used. Computed with the following formula: n8 = ( 0x7 + n0 + n1 + n2 + n3 + n4 + n5 + n6 + n7 ) & 0xf 9

4 Revision history

- In the modulation and bit timing section the inverted keying polarity was corrected, - and some logic analyzer captured samples of RF transmissions were added. - Battery voltage bit found. - Negative temperature value representation specified. - Rain gauge data details were added, - the above required also some rearrangements. Initial release.

2011-01-25

2011-01-18