Wireless thermometers are cheap, last years on a single set of batteries, and are made to be exposed to the elements. Because of this, they are a good alternative to building your own wireless temperature sensor. The following document describes the wireless signal and protocol for one type of these thermometer types.
This is a non exhaustive list of devices for which the following specifications should work. You can recognize the outdoor temperature sensor by its distinguished shape.
Example brands for this thermometer:
- https://www.clasohlson.com/se/Trådlös-termometer-med-magnetfäste/p/36-6721
- https://www.amazon.de/Thermometer-Hygrometer-Indoor-Outdoor-Sensors-White/dp/B01NCSWHS1/
- https://www.amazon.de/Thermometer-Temperatur-Au%C3%9Fensensor-Schalter-Aufzeichnungen/dp/B07JMDVP8G/
- https://www.amazon.de/Monllack-Funk-Thermometer-LCD-Display-Digital-Wand-Temperatur-Messger%C3%A4t-B0127T2/dp/B07JYKWDRF
The sginal was obtained using an RTL-SDR v3 dongle in combination with SDRSharp. Multiple signals were recorded and the temperature values that corresponded with these waves were read from the thermometer base unit and written down.
The signals were then imported in Universal Radio Hacker.There, I experimented with the parameters based on the waveform, and decoded the protocol based on multiple known values.
Frequency: 433,920 - 433,920MHz. Might slightly vary per device or after a battery replacement, but stays the same as long as the device is powered. Bandwidth: Creates a lot of what seems to be harmonics, but a 4kHz bandwidth works nicely to capture the signal. Transmission: About 850ms, every 55 to 60 seconds.
Keying: Amplitude shift keying. Symbols: 1 symbol takes 500µs. When captured with 2,4Megasamples/second, 1200 samples correspond to 1 symbol Bits: 1 symbol is one bit.
- Before the actual transmission starts, eight 1-bits are sent, followed by a pause of 3900µs.
- The actual transmission consists of one message that is repeated 12 times. Each transmission is followed by a pause of 3900µs. Use the repeating signals to detect signals that were received incorrectly.
- The message is around 68000µs long and contains around 141 bits. Note that the message length (in seconds) can change based on the contents.
Example signal:
100001000010010010010000100100100001001001001001001001001000010000100100001001000010010000100001000010000100001001001001001001000010000100001
- A logical one is expressed as 10000
- A logical zero is expressed as 100
The signal can be decoded by inverting it, and then counting the number of ones: two ones for a zero, four ones for a one.
The example signal above becomes
110001001000000011010101111100000111
- The first 16 bits (0-14) are probably the sender address
- The next 10 bits (14-23) contain the temperature measurement in tenths of degree celcius. For example, the message above contains a reading of 21,3 degrees celcius. This becomes 213 in tenths of degree Celcius, and 0011010101 binary.