This post continues the tear down and reverse engineering of the Acurite 0077XW / 00592TX Wireless Remote Temperature Probe Part 1 & Part 2 & Part 3.
A small update to the decoding of the bit stream coming from the remote temperature probes.
It occurred to me the base station has an indicator of remote probe battery condition:
If the base station can display the remote probe battery status, or at least low battery condition, the remote probe must be sending battery status as part of the data stream.
To test the idea that the remote probe sends a low battery status I removed the batteries from a remote probe and hooked up a variable power supply to the battery connections in the remote probe.
I loaded the bit stream decoder from my github repo and watched the bits from the remote probe.
I started with the variable supply set to 3V to match two fresh alkaline batteries. With the voltage at 3V the probe sent the familiar bit stream decoded in Part 3 of this series.
Remote Probe Battery voltage at 3V.
38,6c,44,90,09,50,d1,111000,1101100,1000100,10010000,1001,1010000,11010001,208,695,5836668 38,6c,44,90,09,d1,52,111000,1101100,1000100,10010000,1001,11010001,1010010,209,697,5853130 38,6c,44,90,09,d1,52,111000,1101100,1000100,10010000,1001,11010001,1010010,209,697,5869592
After getting stable readings I started turning down the voltage at the power supply to simulate low batteries. At around 2.5V the pattern changed:
Remote Probe Battery voltage at 2.4V.
38,6c,84,90,09,50,11,111000,1101100,10000100,10010000,1001,1010000,10001,208,695,6100054 38,6c,84,90,09,50,11,111000,1101100,10000100,10010000,1001,1010000,10001,208,695,6116509 38,6c,84,90,09,50,11,111000,1101100,10000100,10010000,1001,1010000,10001,208,695,6132973
Notice in the third byte bits 7 and 6 flip from 0 to 1 and 1 to 0 when the voltage drops below ~2.4V. The byte 0x44 changes to 0x84. The change of the upper nybble from 4 to 8 and back again is repeatable and consistent around 2.4 volts.
In Part 3 of this series I posted that the first and second bytes are the ID bytes, the fifth and sixth bytes are temperature, the seventh byte the checksum, and that the third and fourth bytes never change. During my earlier work I was using fresh batteries in all of the modules and never saw a change in the 3rd and 4th bytes. With a variable power supply hooked up to the probe I am able to simulate a low battery condition and observe a change in the 3rd byte.
Given this new information I can monitor the battery health of the remote probes and change batteries as needed. Monitoring the battery level also gives some insight into battery longevity at different temperatures. I will update my logging to capture battery low indication over time and temperature. I have some probes inside the house and some outside. It will be interesting to see how the batteries discharge compared to temperature history.
The first and second bytes of the data are the unique probe address. The upper two bits of the first byte are the probe channel indicator:
11 = channel A 10 = channel B 00 = channel C
The remaining 6 bits of the first byte and the 8 bits of the second byte are a unique identifier per probe.
The upper nybble of the third byte carries the remote probe low battery indication.
When the remote probe batteries are fresh, voltage above 2.5V, the third byte is 0x44. When the remote probe batteries get low, below 2.4V, the third byte changes to 0x84.
The fourth byte continues to stay at 0x90 for all conditions.
The next two bytes are the temperature value. The temperature is encoded as the lower 7 bits of both bytes with the most significant bit being an even parity bit. The MSB will be set if required to insure an even number of bits are set to 1 in the byte. If the least significant seven bits have an even number of 1 bits set the MSB will be 0, otherwise the MSB will be set to 1 to insure an even number of bits.
The last byte is a simple running sum, modulo 256, of the previous 6 data bytes.
Some other interesting blogs and posts on hacking the Acurite probes:
RF sniffing the Acurite data stream Acurite data stream reverse engineering OregonScientific-RF-Protocols-II.pdf Rays Hobby (great info here)
I hope this series was helpful and if you have any comments, questions, or suggestions please leave a comment below.