Welcome to the Cumulus Support forum.

Latest Cumulus MX V3 release 3.28.6 (build 3283) - 21 March 2024

Cumulus MX V4 beta test release 4.0.0 (build 4018) - 28 March 2024

Legacy Cumulus 1 release v1.9.4 (build 1099) - 28 November 2014 (a patch is available for 1.9.4 build 1099 that extends the date range of drop-down menus to 2030)

Download the Software (Cumulus MX / Cumulus 1 and other related items) from the Wiki

HP1000 / WH24 RF Protocol

Discussion specific to Fine Offset and similar rebadged weather stations
Post Reply
Zodiac69
Posts: 8
Joined: Sat 05 Jan 2013 4:18 pm
Weather Station: WH24
Operating System: Win 7
Location: Cape Town, RSA

HP1000 / WH24 RF Protocol

Post by Zodiac69 »

Hi All
Some time last year i posted some pictures of the inside of a "HP1000" they are also known as WH24 for the outdoor unit or WH2303 as the Weather station set.

Struggled to get info on the NET, until i found a post by "Ohan Smit" on RTL-SDR.com, where he spend a lot of time decoding the signal, see post here - https://www.rtl-sdr.com/reverse-enginee ... n-rtl-sdr/.
This gave me inspiration to look at it again.
The WH24 send a string of date every 16 seconds - the one in my country use 433.920MHz.
1. It is a FSK signal NOT ASK as per the data sheet.
2. Initial decode indicated a bit length of 150uS

After Finding an obscure post on a WH24 that the bit rate is 17.241kbps and the Frequency Shift deviation is 60kHz, everything just started to work.

We have decoded most of it, so here is the RF signal decode, i Used a RFM69HW to receive and decode the signal.
The RF signal is 25 Byte with a 18 Byte Payload
1. Preamble - 5x 0xAA
2. Sync Word - 0x2D and 0xD4

The RFM69 strip the above and only give you the Payload. If you use a device that does NOT do that, you need to take the Preamble and Sync word into consideration. See attached spread sheet for a decode so far.

The last byte changes with every string even thou the other data does not change - I did a binary string on the Payload and no change in the data values, but the last byte changes.
Any help in decoding the unknown bytes and / or correcting mistakes will be appreciated.

Z69
You do not have the required permissions to view the files attached to this post.
AllyCat
Posts: 1124
Joined: Sat 26 Feb 2011 1:58 pm
Weather Station: Fine Offset 1080/1 & 3080
Operating System: Windows XP SP3
Location: SE London

Re: HP1000 / WH24 RF Protocol

Post by AllyCat »

Hi,

Thanks for the update, I've certainly filed away the links for possible future use. For others, I note that your previous posts were on 6th August 2017 and with hindsight it appears that the photo shows an off-the-shelf receiver module , probably using the Si4432 transceiver chip. But of course the actual operational parameters are mainly determined by the initialisation data delivered by the master microcontroller program.

It seems strange that only the last byte is changing; to include a "sequence" number is quite common, but the last byte(s) is/are nearly always a checksum (or FO seem to prefer a CRC), because of the nature of RF communication in general (and the 434 MHz ISM band in particular).

As you've asked for corrections, if I were "proof reading" the XLS as a document, then I would offer the following for consideration:

Personally I would describe the "values in hex(adecimal)" as "values in binary". Normally the manufacturers use either pure binary data fields or BCD (Binary Coded Decimal) data formats and indeed FO seem to (always) use binary. Then to display the data, the fields are often divided into nibbles, represented by either Hex (0 to F) or BCD (0 to 9) characters.

The "Units" for several of the fields would be helpful, in particular wind speed (mph, m/s, km/hr, etc.?), rain counts (mm, inches, and fractional parts, etc.?), UVI and Lux Levels. IIRC in the WH308x models, the Lux level units are in tenths of a Lux which means that the maximum value fits into 22 bits (with the remaining two bits always 0). 16 bits for the UVI seems an enormous range, would that be the "UV Index" (normally a range of 0 to 10+) with three additional decimal places? In the other FO stations (WH108x, 208x,308x, etc.) the wind units are normally 0.75 mph and rain steps 0.3 mm (0.012 in).

There appears to be a "high bit" for wind speed (WSP8) but not for Gust (which should always be at least as high)! Also, I believe that strictly, "add 255 to wind direction" should say "add 256...".

Cheers, Alan.
User avatar
ConligWX
Posts: 1571
Joined: Mon 19 May 2014 10:45 pm
Weather Station: Davis vPro2+ w/DFARS + AirLink
Operating System: Ubuntu 22.04 LTS
Location: Bangor, NI
Contact:

Re: HP1000 / WH24 RF Protocol

Post by ConligWX »

Have you tried contacting Fine OffSet?
Regards Simon

https://www.conligwx.org - @conligwx
Davis Vantage Pro2 Plus with Daytime FARS • WeatherLink Live • Davis AirLink • PurpleAir •

Image
Zodiac69
Posts: 8
Joined: Sat 05 Jan 2013 4:18 pm
Weather Station: WH24
Operating System: Win 7
Location: Cape Town, RSA

Re: HP1000 / WH24 RF Protocol

Post by Zodiac69 »

Hi AllyCat

See attached spreadsheet for WH24 RF Protocol.
I have confirmed the values with Fine Offset.
I have also done some checks on my side and it is now in the range that i expect the values to be if i compare them with other sources in my area.

The 18th byte that is was seeing, still not sure what it is as both my SDR and the RFM69 gave me an 18th packet, but FO indicate that the payload is only 17 Bytes.
15 Bytes of data
1 Byte CRC
1 Byte Checksum

Regards
Z
You do not have the required permissions to view the files attached to this post.
Zodiac69
Posts: 8
Joined: Sat 05 Jan 2013 4:18 pm
Weather Station: WH24
Operating System: Win 7
Location: Cape Town, RSA

Re: HP1000 / WH24 RF Protocol

Post by Zodiac69 »

WH24 - Lux to W/m2 = Lux/126
This was given to me by Fine Offset.
mr.sneezy
Posts: 35
Joined: Sun 30 Jan 2011 3:17 am
Weather Station: WH2081 & WH2900
Operating System: Microsoft
Location: Adelaide, Australia

Re: HP1000 / WH24 RF Protocol

Post by mr.sneezy »

Zodiac69 wrote: Sat 30 Jun 2018 8:18 pm Hi AllyCat

See attached spreadsheet for WH24 RF Protocol.
I have confirmed the values with Fine Offset.
I have also done some checks on my side and it is now in the range that i expect the values to be if i compare them with other sources in my area.

The 18th byte that is was seeing, still not sure what it is as both my SDR and the RFM69 gave me an 18th packet, but FO indicate that the payload is only 17 Bytes.
15 Bytes of data
1 Byte CRC
1 Byte Checksum

Regards
Z
Hi Z,
I have a WH2900 station that I think might use the same FSK modulation and protocol (as it's definately NOT the old OOK). I have an RFM69 shield and various Arduinos at hand. I'd like to replicate your test FSK decoder setup.
Can you tell me what or who's code you used to drive the RFM69 and/or a link to it (assuming it's Arduino based) ?
Anything useful I find out I'll share back to the forum.

Cheers,
Martin
mr.sneezy
Posts: 35
Joined: Sun 30 Jan 2011 3:17 am
Weather Station: WH2081 & WH2900
Operating System: Microsoft
Location: Adelaide, Australia

Re: HP1000 / WH24 RF Protocol

Post by mr.sneezy »

I've had an initial look at the WH2900 RF protocol to compare with the WH24. Similar, FSK, 100uS symbol period...
I'm using an $10 RTL-SDR USB stick receiver, and Universal Radio Hacker open source software. The outdoor station is inside the house with me, the wind vane and wind cups are held static with blue-tac putty (so wind vane can be set, but wind speed is zero). Light & UV levels zero.

Two packets at 23 degrees C, West wind, 42% humidity.
aaaaaaaaaaa56a520a8b4a80017004000b2944
aaaaaaaaaaa56a520a8b4a80017004000b2944

Two packets at 23.7C, East wind, 40% humidity.
aaaaaaaaaaa56a52150baa0002e00800192c0
aaaaaaaaaaa56a521517540005c0100011780

Lots of 0xAA preamble like the WH24, the sync words might be 0x56 and 0xA5, nibble after that is always 0x2
Will try to get a RFM69 dev board to output the same packet via an Arduino next.
Post Reply