| Software Defined RadioReceiving, decoding and displaying weather data from a WT440 Wireless Weather Transmitter |
Source: http://wiki.nethome.nu/doku.php/upmprotocol
The RF-Protocol used by the UPM-Devices uses OOK-modulation of a 433.92 MHz carrier signal.
The digital signal is encoded using an Biphase Differential Manchester Encoding.
The transmitter sends a burst of three messages (for redundancy) every 60 seconds.
One message consists of 32 bits of data prepended by a 4 bit wake up code.
/* * The message consists of four bytes. * x = Wake Up Code (1100) * c = House Code (0 - 15) * d = Device Code (1 - 4) ? * p = Primary value - Temperature/Rain/Wind speed value (low bits) * P = Primary value - Temperature/Rain/Wind speed value (high bits) * s = Secondary value - Humidity/Wind direction (low bits) * S = Secondary value - Humidity/Wind direction (high bits) * b = Low battery indication * z = Sequence number 0 - 2. Messages are sent in bursts of 3. For some senders this is always 0 * C = Checksum. bit 1 is XOR of odd bits, bit 0 XOR of even bits in message * * If HouseCode = 10 and deviceCode = 2, then p and P is Wind speed * and h and H is Wind direction * * If HouseCode = 10 and deviceCode = 3, then p and P is rain * * ____Byte 0_____ ____Byte 1_____ ____Byte 2_____ ____Byte 3_____ _Nib4__ * 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 3 2 1 0 * x x x x c c c c d d 1 1 b S S S s s s s 0 P P P p p p p p p p p z z C C * * Temp (C) = RawValue / 16 - 50 * Rain (total mm) = RawValue * 0.7 * Wind Speed (mph)= RawValue (* 1/3.6 for km/h) * Humidity (%) = RawValue * Wind direction (deg) = RawValue * 45 * */
Turn on your machine and let it boot up.
Plug the RTL2832U into a USB port.
Type in dmesg to see the system log entries of linux finding and configuring the RTL2832U
Here is the log from a Raspberry Pi 3 Model B Plus Rev 1.3
$ dmesg [5875793.155531] usb 1-1.3: USB disconnect, device number 5 [6276815.400286] usb 1-1.2: new high-speed USB device number 6 using dwc_otg [6276815.542226] usb 1-1.2: New USB device found, idVendor=0bda, idProduct=2838, bcdDevice= 1.00 [6276815.542242] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [6276815.542252] usb 1-1.2: Product: RTL2832UHIDIR [6276815.542261] usb 1-1.2: Manufacturer: Realtek [6276815.542270] usb 1-1.2: SerialNumber: 00000001 [6276815.666401] usb 1-1.2: dvb_usb_v2: found a 'Realtek RTL2832U reference design' in warm state [6276815.719837] usb 1-1.2: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [6276815.719869] dvbdev: DVB: registering new adapter (Realtek RTL2832U reference design) [6276815.736801] i2c i2c-3: Added multiplexed i2c bus 4 [6276815.736809] rtl2832 3-0010: Realtek RTL2832 successfully attached [6276815.736861] usb 1-1.2: DVB: registering adapter 0 frontend 0 (Realtek RTL2832 (DVB-T))... [6276815.750811] r820t 4-001a: creating new instance [6276815.757629] r820t 4-001a: Rafael Micro r820t successfully identified [6276815.766751] Registered IR keymap rc-empty [6276815.766845] rc rc0: Realtek RTL2832U reference design as /devices/platform/soc/3f980000.usb/usb1/1-1/1-1.2/rc/rc0 [6276815.766947] input: Realtek RTL2832U reference design as /devices/platform/soc/3f980000.usb/usb1/1-1/1-1.2/rc/rc0/input0 [6276815.767063] rc rc0: lirc_dev: driver dvb_usb_rtl28xxu registered at minor = 0, raw IR receiver, no transmitter [6276815.767163] usb 1-1.2: dvb_usb_v2: schedule remote query interval to 200 msecs [6276815.779587] usb 1-1.2: dvb_usb_v2: 'Realtek RTL2832U reference design' successfully initialized and connected [6276815.779788] usbcore: registered new interface driver dvb_usb_rtl28xxu
GQRX Screenshot of UPM Three Message Burst
Watch GRXQ. When you see the burst, note exactly where the second hand is on an analog clock.
My WT440 transmits exactly every 60 seconds and does so when the second hand is at "FIVE TO".
$ apt-get install libusb-1.0-0-dev
$ apt-get install rtl-sdr
$ rtl_test
Found 1 device(s):
0: Generic, RTL2832U, SN: 77771111153705700
Using device 0: Generic RTL2832U
Detached kernel driver
Found Rafael Micro R820T tuner
Supported gain values (29):
0.0 0.9 1.4 2.7 3.7 7.7 8.7 12.5 14.4 15.7 16.6
19.7 20.7 22.9 25.4 28.0 29.7 32.8 33.8 36.4 37.2
38.6 40.2 42.1 43.4 43.9 44.5 48.0 49.6
[R82XX] PLL not locked!
Sampling at 2048000 S/s.
Info: This tool will continuously read from the device, and report if
samples get lost. If you observe no further output, everything is fine.
Reading samples in async mode...
^C
Signal caught, exiting!
$ rtl_sdr
rtl_sdr, an I/Q recorder for RTL2832 based DVB-T receivers
Usage: -f frequency_to_tune_to [Hz]
[-s samplerate (default: 2048000 Hz)]
[-d device_index (default: 0)]
[-g gain (default: 0 for auto)]
[-p ppm_error (default: 0)]
[-b output_block_size (default: 16 * 16384)]
[-n number of samples to read (default: 0, infinite)]
[-S force sync output (default: async)]
filename (a '-' dumps samples to stdout)
Close GQRX so the RTL_SDR can use the USB Dongle.
Otherwise you will get this message:
Failed to open rtlsdr device #0.
Start the capture 2 seconds before it transmits so that linux has enough time to intialize everything.
I captured only 5 seconds to make the burst easier to find and captured at 1024000 bits/second so the file is smaller.
I tried different gain numbers until I got one (28.0 dB) that did not clip and gave a good strong signal.
I used 433889000 HZ as the frequency as that was closer to the actual frequency.
# rtl_sdr capture.bin -f 433889000 -s 1024000 -g 28.0 -n 5120000 Found 1 device(s): 0: Generic, RTL2832U, SN: 77771111153705700 Using device 0: Generic RTL2832U Detached kernel driver Found Rafael Micro R820T tuner [R82XX] PLL not locked! Sampling at 1024000 S/s. Tuned to 433889000 Hz. Tuner gain set to 28.00 dB. Reading samples in async mode... User cancel, exiting... Reattached kernel driver
Settings for File Import of "capture.bin"
