Page 1 of 1

HP1000 / WH24 RF Protocol

Posted: Sun 24 Jun 2018 1:51 pm
by Zodiac69
Hi All
Some time last year i posted some pictures of the inside of a "HP1000" they are also known as WH24 for the outdoor unit or WH2303 as the Weather station set.

Struggled to get info on the NET, until i found a post by "Ohan Smit" on RTL-SDR.com, where he spend a lot of time decoding the signal, see post here - https://www.rtl-sdr.com/reverse-enginee ... n-rtl-sdr/.
This gave me inspiration to look at it again.
The WH24 send a string of date every 16 seconds - the one in my country use 433.920MHz.
1. It is a FSK signal NOT ASK as per the data sheet.
2. Initial decode indicated a bit length of 150uS

After Finding an obscure post on a WH24 that the bit rate is 17.241kbps and the Frequency Shift deviation is 60kHz, everything just started to work.

We have decoded most of it, so here is the RF signal decode, i Used a RFM69HW to receive and decode the signal.
The RF signal is 25 Byte with a 18 Byte Payload
1. Preamble - 5x 0xAA
2. Sync Word - 0x2D and 0xD4

The RFM69 strip the above and only give you the Payload. If you use a device that does NOT do that, you need to take the Preamble and Sync word into consideration. See attached spread sheet for a decode so far.

The last byte changes with every string even thou the other data does not change - I did a binary string on the Payload and no change in the data values, but the last byte changes.
Any help in decoding the unknown bytes and / or correcting mistakes will be appreciated.

Z69

Re: HP1000 / WH24 RF Protocol

Posted: Mon 25 Jun 2018 4:26 pm
by AllyCat
Hi,

Thanks for the update, I've certainly filed away the links for possible future use. For others, I note that your previous posts were on 6th August 2017 and with hindsight it appears that the photo shows an off-the-shelf receiver module , probably using the Si4432 transceiver chip. But of course the actual operational parameters are mainly determined by the initialisation data delivered by the master microcontroller program.

It seems strange that only the last byte is changing; to include a "sequence" number is quite common, but the last byte(s) is/are nearly always a checksum (or FO seem to prefer a CRC), because of the nature of RF communication in general (and the 434 MHz ISM band in particular).

As you've asked for corrections, if I were "proof reading" the XLS as a document, then I would offer the following for consideration:

Personally I would describe the "values in hex(adecimal)" as "values in binary". Normally the manufacturers use either pure binary data fields or BCD (Binary Coded Decimal) data formats and indeed FO seem to (always) use binary. Then to display the data, the fields are often divided into nibbles, represented by either Hex (0 to F) or BCD (0 to 9) characters.

The "Units" for several of the fields would be helpful, in particular wind speed (mph, m/s, km/hr, etc.?), rain counts (mm, inches, and fractional parts, etc.?), UVI and Lux Levels. IIRC in the WH308x models, the Lux level units are in tenths of a Lux which means that the maximum value fits into 22 bits (with the remaining two bits always 0). 16 bits for the UVI seems an enormous range, would that be the "UV Index" (normally a range of 0 to 10+) with three additional decimal places? In the other FO stations (WH108x, 208x,308x, etc.) the wind units are normally 0.75 mph and rain steps 0.3 mm (0.012 in).

There appears to be a "high bit" for wind speed (WSP8) but not for Gust (which should always be at least as high)! Also, I believe that strictly, "add 255 to wind direction" should say "add 256...".

Cheers, Alan.

Re: HP1000 / WH24 RF Protocol

Posted: Mon 25 Jun 2018 4:29 pm
by ConligWX
Have you tried contacting Fine OffSet?

Re: HP1000 / WH24 RF Protocol

Posted: Sat 30 Jun 2018 8:18 pm
by Zodiac69
Hi AllyCat

See attached spreadsheet for WH24 RF Protocol.
I have confirmed the values with Fine Offset.
I have also done some checks on my side and it is now in the range that i expect the values to be if i compare them with other sources in my area.

The 18th byte that is was seeing, still not sure what it is as both my SDR and the RFM69 gave me an 18th packet, but FO indicate that the payload is only 17 Bytes.
15 Bytes of data
1 Byte CRC
1 Byte Checksum

Regards
Z

Re: HP1000 / WH24 RF Protocol

Posted: Fri 27 Jul 2018 4:30 pm
by Zodiac69
WH24 - Lux to W/m2 = Lux/126
This was given to me by Fine Offset.

Re: HP1000 / WH24 RF Protocol

Posted: Tue 18 Dec 2018 5:46 am
by mr.sneezy
Zodiac69 wrote: Sat 30 Jun 2018 8:18 pm Hi AllyCat

See attached spreadsheet for WH24 RF Protocol.
I have confirmed the values with Fine Offset.
I have also done some checks on my side and it is now in the range that i expect the values to be if i compare them with other sources in my area.

The 18th byte that is was seeing, still not sure what it is as both my SDR and the RFM69 gave me an 18th packet, but FO indicate that the payload is only 17 Bytes.
15 Bytes of data
1 Byte CRC
1 Byte Checksum

Regards
Z
Hi Z,
I have a WH2900 station that I think might use the same FSK modulation and protocol (as it's definately NOT the old OOK). I have an RFM69 shield and various Arduinos at hand. I'd like to replicate your test FSK decoder setup.
Can you tell me what or who's code you used to drive the RFM69 and/or a link to it (assuming it's Arduino based) ?
Anything useful I find out I'll share back to the forum.

Cheers,
Martin

Re: HP1000 / WH24 RF Protocol

Posted: Mon 14 Jan 2019 1:06 pm
by mr.sneezy
I've had an initial look at the WH2900 RF protocol to compare with the WH24. Similar, FSK, 100uS symbol period...
I'm using an $10 RTL-SDR USB stick receiver, and Universal Radio Hacker open source software. The outdoor station is inside the house with me, the wind vane and wind cups are held static with blue-tac putty (so wind vane can be set, but wind speed is zero). Light & UV levels zero.

Two packets at 23 degrees C, West wind, 42% humidity.
aaaaaaaaaaa56a520a8b4a80017004000b2944
aaaaaaaaaaa56a520a8b4a80017004000b2944

Two packets at 23.7C, East wind, 40% humidity.
aaaaaaaaaaa56a52150baa0002e00800192c0
aaaaaaaaaaa56a521517540005c0100011780

Lots of 0xAA preamble like the WH24, the sync words might be 0x56 and 0xA5, nibble after that is always 0x2
Will try to get a RFM69 dev board to output the same packet via an Arduino next.