Author Topic: WH2A 433MHz T/RH sensor protocol  (Read 317 times)

navstar and 1 Guest are viewing this topic.

Online navstar

  • Member
  • *
  • Posts: 6
WH2A 433MHz T/RH sensor protocol
« on: April 16, 2017, 01:01:48 PM »
Hello,

Recently I bought myself a pair of chinese external wireless temperature/humidity sensors  --> https://www.aliexpress.com/item/Transmitter-for-professional-Wireless-Weather-Station-wireless-temperature-sensor-outdoor-sensor-for-humidity-and-temperature/32790517557.html?scm=1007.13339.33317.0&pvid=f0d5b35c-cfee-4d5a-af9f-4032db8aeead&tpp=1

Labeled WH2A these devices have the same look as the much more popular and well documented --> WH2. But it turned out the protocols both types of sensors use are different.

I couldn't find any description of the protocol WH2A devices use, so using some guidance from few web authors I started reverse engineering it.

I pretty much discovered the important part (the format of the data), but I'm really stuck with understanding the type of what seems to be a 16 bit checksum, the data packet integrates. Of course it is not so important, I still can use the sensors, but it really frustrates me. Also, being able to detect impairments of the data is always a good thing.

Inspired from the forum member aweatherguy's series of docs on the wireless protocols and sensors, I reached this forum, hoping to find some help from the experience and expertise accumulated here.

So here is a sample of the protocol in action:



I'm not sure if bits 8-11 are also used for device type, but it is not so much of importance.

The puzzle here (at least for me) are bits 40-55. It is obviously some kind of checksum - and more of a CRC kind. It changes drastically even if a single bit changes in the data fields. Some examples:

1111111 0100 11010100 000011011010 00110000 0111010000001011 0000
1111111 0100 11010100 000011010011 00110101 0100001011010111 0000
1111111 0100 11010100 000011010100 00110101 1110110010000010 0000
1111111 0100 11010100 000011010100 00110100 1101110101110010 0000


I have tried using the reveng tool for bruteforcing an eventual CRC flavor, but without success. Also in all the protocol examples I was able to find, there was never 16 bit CRC fields...

I'm already out of ideas and any help will be much appreciated!

Best regards!

Offline vreihen

  • El Niņo chaser
  • Forecaster
  • *****
  • Posts: 631
Re: WH2A 433MHz T/RH sensor protocol
« Reply #1 on: April 16, 2017, 01:19:18 PM »
Have you seen/looked at this code yet?????

http://www.nemcon.nl/blog2/

Online navstar

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #2 on: April 16, 2017, 02:08:34 PM »
Hi,

Thanks for the fast reaction. Indeed, I've checked the suggested site and the forum. However I wasn't able to find any details about the protocol. There is a feature request in the forum and there is subsequent announce the WH2A support is implemented. But I couldn't find any information or discussion disclosing the protocol specifics.  Neither there is any code related to WH2A in the source codes available on their site. It is not even clear whether they've implemented the actual checksum algorithm.

Best regards!

Offline dupreezd

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #3 on: April 17, 2017, 08:40:27 AM »
That device looks just like my Ambient indoor sensor which apart from Temp and Hum, also provides barometric pressure. Maybe part of the last bits contains the pressure?
WS-1200-IP | ObserverIP
WU - KTXCONRO61
CWOP - fw0717


Online navstar

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #4 on: April 17, 2017, 09:21:59 AM »
Hello,

I've opened it. There is no barometric sensor. Also the randomness of the values suggests they are not  measurement data.

Best regards!

Offline vreihen

  • El Niņo chaser
  • Forecaster
  • *****
  • Posts: 631
Re: WH2A 433MHz T/RH sensor protocol
« Reply #5 on: April 17, 2017, 10:21:15 AM »
Out of curiosity, how do they code negative temperatures?  Two's compliment?????

Online navstar

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #6 on: April 17, 2017, 10:37:13 AM »
Bit 20 when set represents the "-" sign. So the 12 bit temperature field is what is known as signed integer.

Offline dupreezd

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #7 on: April 18, 2017, 09:27:27 AM »
I managed to solve figure out how it is done. I am not attempting to tell you something you might already know, but other readers might learn something.

So here goes: 
The first 7 preamble (or sync bits) is used by the transmitter to wake up the receiver so it can sync its data clock with the incoming bits. (On you marks, get set, go). The Sync bits are not part of the data packet.  The same for the last 4 bits. It is the transmitter telling the receiver it is done sending and it can go off and do its thing.

That leaves us with 48 data bits. No need for 16 bits of CRC on such a short data packet. So, I reasoned that the data is from 8 to 47 and the CRC 48 to 55.

Also note that having sync bits, the data is serial and being clocked into a serial shift register.

I then remembered working with serial data, PLC and SCADA devices that Checksum8 Modulo 256 was/is very popular due to its low overhead and speed. A quick search and I found this link.
 
http://www.scadacore.com/field-tools/programming-calculators/online-checksum-calculator/


Using the data you provided, I converted bits 8 to 47 to Hex and plugged it into the calculator. Success on all four.

If you have more data, you can run more tests.

For bits 40 to 47, you are back to the drawing board.  :-) My guess it is humidity. Pull the PCB and see if there are any unsoldered pads near the edge. If there are, it might be floating inputs which is a big no-no in electronic design. They should be terminated with either a pull down or pull up resister. This might explain the bit changes in those 8 bits. On the other hand, it might be some other data.

Hope this help
WS-1200-IP | ObserverIP
WU - KTXCONRO61
CWOP - fw0717


Offline dupreezd

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #8 on: April 18, 2017, 02:31:37 PM »
OOPS - For bits 40 to 47, you are back to the drawing board.  :-) My guess it is humidity.

Should read
For bits 40 to 47, you are back to the drawing board.  :-) My guess it is Pressure.
WS-1200-IP | ObserverIP
WU - KTXCONRO61
CWOP - fw0717


Online navstar

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #9 on: April 18, 2017, 04:35:52 PM »
dupreezd,

Hats down! You are absolutely correct! Indeed it turned out the checksum is MOD256 on the sum of all bytes from bit 8 till bit 47. Thank you very much. I would never guess. I don't have much of an experience with the serial transmission protocols... And my quick research on the 433MHz wireless temperature  sensors never showed this one utilized.

Regarding bits 40-47 - for sure it is not pressure reading. On the first place there is no pressure sensor implemented in the device. On second - the readings are way too random and non of them gets even close to any measure of atmospheric preassure (mmHg, milibars, hectopascals). It is inconsistence even with an eventual attempt for delta value in reference to fixed (reference) value. Seems like it is just some random value derived who knows how. Some kind of entropy. And it fooled me quite successfully making me go towards the CRC16 speculation (which for sure would be an overshoot).

Thanks again! I would mark this SOLVED with pleasure!

Offline dupreezd

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #10 on: April 18, 2017, 04:53:12 PM »
Navstar, the randomness of those bits, is why I think there are floating inputs and you might be able to solder a baro sensor to the board.
WS-1200-IP | ObserverIP
WU - KTXCONRO61
CWOP - fw0717


Online navstar

  • Member
  • *
  • Posts: 6
Re: WH2A 433MHz T/RH sensor protocol
« Reply #11 on: April 19, 2017, 06:10:34 AM »
Thanks. I'll investigate this option.

 

anything