I was interested in doing some datalogging of weather conditions around my house. Some kind of wireless sensor network is obviously attractive for this purpose given that there’s no cabling to be done. Rather than rolling my own protocol and making my own sensors, I thought I’d see if I could reverse engineer the packets from an existing outdoor sensor.

I’ve had a wireless weather station that used a WH2 outdoor weather sensor for a few years now. A bit of googling revealed that these are made by Fine Offset Electronics. The remote sensor measures both temperature and humidity. They interface to several different kinds of indoor weather stations produced by Fine Offset. One such unit, catalogue number X7020,  is sold by Altronics here in Australia. There are plenty of similar units listed on ebay. The unit from Altronics is shown below:

Here is what the indoor display unit looks like:

And here’s the bit we’re interested in - the outdoor sensor unit:

Taking the outdoor sensor unit apart reveals a fairly typical green circuit board. In the foreground is the  microcontroller under the black epoxy blob. There’s a tuning fork crystal to maintain a fairly accurate interval between packets. There’s a bunch of gold plated pads that contact with the elastomer of the front LCD. To the back is a simple 433MHz/434MHz transmitter for sending the packets to the indoor unit:

The underside doesn’t contain much circuitry at all. The rectangular white thing is the humidity senor and the little black blob immediately above it is the temperature sensor (probably a simple thermistor). There’s also a crystal can or SAW resonator to keep the transmitter working at the right frequency:

It was fairly easy to locate the trace that drives the transmitter with the packet data. It’s a simple on-off keying arrangement - a high on this trace turns the transmitter on; a low turns it off. I soldered the white wire to this point; the black wire is soldered to ground.

Here’s what my Saleae Logic logic analyser recorded when I connected it to the black and white wires. I acquired a number of samples of complete packets and recorded the temperature and humidity displayed on the unit’s LCD at the time each packet was recorded. In order to get a good spread of readings (including some negative temperatures), I gave the sensors a good blast of freezer spray at times!

Using the Logic software’s export functionality, I produced some CSV files of the samples, which I then plotted side-by-side with GNUPlot. (For a tutorial on the topic see here). This dramatically simplified the process of working out the differences between the packets. And a fair bit of scrawling and thinking later, I had a good idea of the protocol:

That’s it for this installment. I plan several more parts to this write-up, the next being a detailed explanation of the protocol used by the WH2 remote sensor.