Overview
Specifications
Product:
Info | URL |
---|---|
Website | https://www.acurite.com/kbase/thermometers/00606_Thermometer.html |
Manual | https://www.acurite.com/media/manuals/00606-instructions.pdf |
Transmitter:
Specification | Value |
---|---|
Model | 00606TXA1 |
FCC ID | RNE606TXA1 |
Receiver:
Specification | Value |
---|---|
Model | 00606TXA1 |
FCC ID | RNE606TXA1 |
RTL_433 Reverse Engineering
Using rtl_433:
> rtl_433
Output:
rtl_433 version 19.08-18-g8eecdbb branch master at 201909241811 inputs file rtl_tcp RTL-SDR Use -h for usage help and see https://triq.org/ for documentation. Trying conf file at "rtl_433.conf"... Trying conf file at "/Users/john.mehan/.config/rtl_433/rtl_433.conf"... Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"... Trying conf file at "/etc/rtl_433/rtl_433.conf"... Consider using "-M newmodel" to transition to new model keys. This will become the default someday. A table of changes and discussion is at https://github.com/merbanan/rtl_433/pull/986. Registered 108 out of 138 device decoding protocols [ 1-4 8 11-12 15-17 19-21 23 25-26 29-36 38-60 63 67-71 73-100 102-103 108-116 119 121 124-128 131-138 ] Found Rafael Micro R820T tuner Exact sample rate is: 250000.000414 Hz [R82XX] PLL not locked! Sample rate set to 250000 S/s. Tuner gain set to Auto. Tuned to 433.920MHz. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ time : 2019-10-03 11:08:26 model : Acurite 606TX Sensor id : 120 Battery : OK Temperature: 25.9 C Integrity : CHECKSUM
> rtl
Detected OOK package 2019-10-03 11:49:46 Analyzing pulses... Total count: 237, width: 744.45 ms (186112 S) Pulse width distribution: [ 0] count: 237, width: 508 us [496;516] ( 127 S) Gap width distribution: [ 0] count: 154, width: 1932 us [1924;1944] ( 483 S) [ 1] count: 70, width: 3884 us [3876;3896] ( 971 S) [ 2] count: 5, width: 468 us [460;476] ( 117 S) [ 3] count: 6, width: 8520 us [8516;8532] (2130 S) [ 4] count: 1, width: 708 us [708;708] ( 177 S) Pulse period distribution: [ 0] count: 154, width: 2440 us [2432;2456] ( 610 S) [ 1] count: 70, width: 4392 us [4380;4408] (1098 S) [ 2] count: 5, width: 972 us [972;980] ( 243 S) [ 3] count: 6, width: 9032 us [9028;9040] (2258 S) [ 4] count: 1, width: 1220 us [1220;1220] ( 305 S) Level estimates [high, low]: 15939, 1378 RSSI: -0.1 dB SNR: 10.6 dB Noise: -10.7 dB Frequency offsets [F1, F2]: 18554, 0 (+70.8 kHz, +0.0 kHz) Guessing modulation: Pulse Position Modulation with fixed pulse width Attempting demodulation... short_width: 468, long_width: 708, reset_limit: 8536, sync_width: 0 Use a flex decoder with -X 'n=name,m=OOK_PPM,s=468,l=708,g=712,r=8536' pulse_demod_ppm(): Analyzer Device bitbuffer:: Number of rows: 25 [00] { 0} : [01] { 0} : [02] { 0} : [03] { 0} : [04] { 0} : [05] { 0} : [06] { 0} : [07] { 0} : [08] { 0} : [09] { 0} : [10] { 0} : [11] { 0} : [12] { 0} : [13] { 0} : [14] { 0} : [15] { 0} : [16] { 0} : [17] { 0} : [18] { 0} : [19] { 0} : [20] { 0} : [21] { 0} : [22] { 0} : [23] { 0} : [24] { 0} : ... Maximum number of rows reached. Message is likely truncated.
What is an OOK package?
On Off Keying is a form of Amplitude Shift Keying (ASK) limited to two values. If you use ASK with only two values, you are essentially using OOK.
Finding the Bits
Install Let's install Universal Radio Hacker
> pip3 install urh
Running URH
> urh
From the initial window, select File → Record Signal
Click Start button and once you noticed your signal, click Stop and Save. Close the window
The Interpretation Screen should appear.
- zoom in on the first burst.
- Set the signal view to Demodulated.
Data:
1110 0110 1000 0001 0011 0110 0001 0011 (E6813613)
Rolling Code: 1110 0110 (E6)
Status: 1000 (8)
Temperature: 0001 0011 0110 (136) = 31.0 C
Hash: 0001 0011 (13)
0.5 ms pulse
2 ms off for 0
4 ms off for 1
0.5 ms for stop bit
9 ms gap between repeats
repeat the whole thing a total of 7 times.
From Protocol Doc:
All in nibbles (4 bits).
Rolling Code(2), Status(1), Temperature (signed binary), Hash Code
AcuRite 00606TX and 00782W3
These sensors have identical formats and add yet more variation in data encoding. Data bits are sent in big-endian order and nibbles are also in bigendian order (opposite to the 0964TX sensor). The data packet length is also different at 32 bits.
The status nibble's MSB is a "battery okay" flag which is normally one. It goes to zero when the battery drops below about 2.6 volts or so.
Temperature is a signed 12-bit value with resolution of 0.1C. For example, 25.6C is encoded as the value 256 (0x100 hexadecimal). A value of -0.1C is encoded as -1 (0xFFF hexadecimal).
There is an 8-bit hash code appended to check message integrity. It is the same algorithm as described for the Ambient Weather F007TH sensor below with two minor modifications. 1. The hash code value is initialized to zero instead of hexadecimal "0x64". 2. Start with the fifth value in the LFSR sequence depicted for the F007TH sensor -- 0xF1 instead of the first value, 0x3E.
References
Reference | URL |
---|---|
FCC Info | https://fccid.io/RNE606TXA1 |
RF Protocol | http://www.osengr.org/WxShield/Downloads/Weather-Sensor-RF-Protocols.pdf |
On Off Keying | https://www.youtube.com/watch?v=w6V9NyXwohI |