Overview
Specifications
Product:
| Info | URL |
|---|---|
| Website | https://www.acurite.com/kbase/thermometers/00606_Thermometer.html |
| Manual | https://www.acurite.com/media/manuals/00606-instructions.pdf |
Transmitter:
| Specification | Value |
|---|---|
| Model | 00606TXA1 |
| FCC ID | RNE606TXA1 |
Receiver:
| Specification | Value |
|---|---|
| Model | 00606TXA1 |
| FCC ID | RNE606TXA1 |
RTL_433 Reverse Engineering
Using rtl_433:
> rtl_433
Output:
rtl_433 version 19.08-18-g8eecdbb branch master at 201909241811 inputs file rtl_tcp RTL-SDR Use -h for usage help and see https://triq.org/ for documentation. Trying conf file at "rtl_433.conf"... Trying conf file at "/Users/john.mehan/.config/rtl_433/rtl_433.conf"... Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"... Trying conf file at "/etc/rtl_433/rtl_433.conf"... Consider using "-M newmodel" to transition to new model keys. This will become the default someday. A table of changes and discussion is at https://github.com/merbanan/rtl_433/pull/986. Registered 108 out of 138 device decoding protocols [ 1-4 8 11-12 15-17 19-21 23 25-26 29-36 38-60 63 67-71 73-100 102-103 108-116 119 121 124-128 131-138 ] Found Rafael Micro R820T tuner Exact sample rate is: 250000.000414 Hz [R82XX] PLL not locked! Sample rate set to 250000 S/s. Tuner gain set to Auto. Tuned to 433.920MHz. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ time : 2019-10-03 11:08:26 model : Acurite 606TX Sensor id : 120 Battery : OK Temperature: 25.9 C Integrity : CHECKSUM
> rtl
Detected OOK package 2019-10-03 11:49:46
Analyzing pulses...
Total count: 237, width: 744.45 ms (186112 S)
Pulse width distribution:
[ 0] count: 237, width: 508 us [496;516] ( 127 S)
Gap width distribution:
[ 0] count: 154, width: 1932 us [1924;1944] ( 483 S)
[ 1] count: 70, width: 3884 us [3876;3896] ( 971 S)
[ 2] count: 5, width: 468 us [460;476] ( 117 S)
[ 3] count: 6, width: 8520 us [8516;8532] (2130 S)
[ 4] count: 1, width: 708 us [708;708] ( 177 S)
Pulse period distribution:
[ 0] count: 154, width: 2440 us [2432;2456] ( 610 S)
[ 1] count: 70, width: 4392 us [4380;4408] (1098 S)
[ 2] count: 5, width: 972 us [972;980] ( 243 S)
[ 3] count: 6, width: 9032 us [9028;9040] (2258 S)
[ 4] count: 1, width: 1220 us [1220;1220] ( 305 S)
Level estimates [high, low]: 15939, 1378
RSSI: -0.1 dB SNR: 10.6 dB Noise: -10.7 dB
Frequency offsets [F1, F2]: 18554, 0 (+70.8 kHz, +0.0 kHz)
Guessing modulation: Pulse Position Modulation with fixed pulse width
Attempting demodulation... short_width: 468, long_width: 708, reset_limit: 8536, sync_width: 0
Use a flex decoder with -X 'n=name,m=OOK_PPM,s=468,l=708,g=712,r=8536'
pulse_demod_ppm(): Analyzer Device
bitbuffer:: Number of rows: 25
[00] { 0} :
[01] { 0} :
[02] { 0} :
[03] { 0} :
[04] { 0} :
[05] { 0} :
[06] { 0} :
[07] { 0} :
[08] { 0} :
[09] { 0} :
[10] { 0} :
[11] { 0} :
[12] { 0} :
[13] { 0} :
[14] { 0} :
[15] { 0} :
[16] { 0} :
[17] { 0} :
[18] { 0} :
[19] { 0} :
[20] { 0} :
[21] { 0} :
[22] { 0} :
[23] { 0} :
[24] { 0} :
... Maximum number of rows reached. Message is likely truncated.
What is an OOK package?
On Off Keying is a form of Amplitude Shift Keying (ASK) limited to two values. If you use ASK with only two values, you are essentially using OOK.
Finding the Bits
Install Let's install Universal Radio Hacker
> pip3 install urh
Running URH
> urh
From the initial window, select File → Sniff Protocol
Setup like the above window above and click Start.
Data:
111110000011111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111000000011111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 111110000011111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111 11111
From Protocol Doc:
AcuRite 00606TX and 00782W3
These sensors have identical formats and add yet more variation in data encoding. Data bits are sent in big-endian order and nibbles are also in bigendian order (opposite to the 0964TX sensor). The data packet length is also different at 32 bits.
The status nibble's MSB is a "battery okay" flag which is normally one. It goes to zero when the battery drops below about 2.6 volts or so.
Temperature is a signed 12-bit value with resolution of 0.1C. For example, 25.6C is encoded as the value 256 (0x100 hexadecimal). A value of -0.1C is encoded as -1 (0xFFF hexadecimal).
There is an 8-bit hash code appended to check message integrity. It is the same algorithm as described for the Ambient Weather F007TH sensor below with two minor modifications. 1. The hash code value is initialized to zero instead of hexadecimal "0x64". 2. Start with the fifth value in the LFSR sequence depicted for the F007TH sensor -- 0xF1 instead of the first value, 0x3E.
References
| Reference | URL |
|---|---|
| FCC Info | https://fccid.io/RNE606TXA1 |
| RF Protocol | http://www.osengr.org/WxShield/Downloads/Weather-Sensor-RF-Protocols.pdf |
| On Off Keying | https://www.youtube.com/watch?v=w6V9NyXwohI |