Pico Tech - Door Chime


Front Page | Recent Changes | Site Map | Login

Diy Links / Rtl Sdr / Rtl Four Three Three How To

Door Chime

Honeywell Wireless Doorbell

Honeywell RCWL330A100/N P4-Premium Portable Wireless Door Chime and Push Button
http://www.honeywellstore.com/store/products/honeywell-rcwl330a100n-p4-premium-portable-wireless-door-chime.htm

Honeywell RCA902N1004/N Wireless Motion Detector
http://www.honeywellstore.com/store/products/honeywell-rca902n1004n-wireless-motion-detector.htm

Honeywell RPWL300A1007/A Decor Wireless Surface Mount Push Button for Door Chime
http://www.honeywellstore.com/store/products/honeywell-rpwl300a1007a-decor-wireless-surface-mount-door-chime-push-button.htm

PIC16F505 1442RY2
http://www.microchip.com/wwwproducts/en/PIC16F505

TH 72031.2 1507 FSK Transmitter - 868/915 MHz
https://www.melexis.com/en/product/TH72031/FSK-Transmitter

Hardware
NooElec NESDR Nano 2: Tiny RTL-SDR USB Set w/ R820T2 Tuner, Antenna and Remote Control
http://www.nooelec.com/store/sdr/nesdr-nano2.html

windows Binary of rtl_433.
http://cognito.me.uk/computers/rtl_433-windows-binary-32-bit/

Rtl Four Three Three How To

Cubic SDR
http://cubicsdr.readthedocs.io/en/latest/application-window.html#basic-feature-outline

916.8 (916.81)
916.71

914.79
914.89

918.73
919.45

919.99

rtl_433.exe -f 916800000 -A 

 

pulse_FSK_detect(): Maximum number of pulses reached!
Detected FSK package
Analyzing pulses...
Total count: 1200,  width: 148945		(595.8 ms)
Pulse width distribution:
 [ 0] count:    1,  width:     0 [ 0; 0]	(   0 us)
 [ 1] count:   25,  width:   119 [119;121]	( 476 us)
 [ 2] count:  448,  width:    79 [78;82]	( 316 us)
 [ 3] count:  726,  width:    39 [38;42]	( 156 us)
Gap width distribution:
 [ 0] count:    1,  width:  2065 [2065;2065]	(8260 us)
 [ 1] count:   25,  width:   121 [121;122]	( 484 us)
 [ 2] count:  448,  width:    40 [38;44]	( 160 us)
 [ 3] count:  725,  width:    80 [78;82]	( 320 us)
Pulse period distribution:
 [ 0] count:    1,  width:  2065 [2065;2065]	(8260 us)
 [ 1] count:   25,  width:   241 [240;242]	( 964 us)
 [ 2] count: 1173,  width:   120 [117;124]	( 480 us)
Level estimates [high, low]:  15960,     19
Frequency offsets [F1, F2]:    3537, -23504	(+13.5 kHz, -89.7 kHz)
Guessing modulation: Pulse Code Modulation (Not Return to Zero)
Attempting demodulation... short_limit: 39, long_limit: 39, reset_limit: 39936, demod_arg: 0
pulse_demod_pcm(): Analyzer Device 
bitbuffer:: Number of rows: 1 
[00] {640} 00 00 00 00 00 00 07 1b 6d b6 d3 6d 26 d3 6d 24 92 69 24 92 49 24 92 49 24 dc 6d b6 db 4d b4 9b 4d b4 92 49 a4 92 49 24 92 49 24 93 71 b6 db 6d 36 d2 6d 36 d2 49 26 92 49 24 92 49 24 92 4d c6 db 6d b4 db 49 b4 db 49 24 9a 49 24 92 49 24 92 


$ ./rtl_433.exe -f 916800000   -z 58 -x 99 -A 2>&1 | python getdat.py
Starting. Use Ctrl-C to stop.

Front Door:

2016-09-13 00:21:29.640323 pulse_demod_pcm() 15803 1393
ed 67 10 20 00 01 : 11101101 01100111 00010000 00100000 00000000 00000001

2016-09-13 00:21:41.171983 pulse_demod_pcm() 15848 1606
ed 67 10 20 00 01 : 11101101 01100111 00010000 00100000 00000000 00000001



PIR Motion sensor stair:

2016-09-13 00:23:15.025351 pulse_demod_pwm_ternary() 15885 851
30 93 90 10 00 01 : 00110000 10010011 10010000 00010000 00000000 00000001

2016-09-13 00:23:19.741621 pulse_demod_pwm_ternary() 15855 954
30 93 90 10 00 01 : 00110000 10010011 10010000 00010000 00000000 00000001



Back door: (What happens when battery is low?)

2016-09-13 00:23:42.806940 pulse_demod_pcm() 15914 674
ff 50 80 20 00 00 : 11111111 01010000 10000000 00100000 00000000 00000000

2016-09-13 00:23:51.719450 pulse_demod_pcm() 15968 888
ff 50 80 20 00 00 : 11111111 01010000 10000000 00100000 00000000 00000000

2016-09-13 00:23:53.817570 pulse_demod_pcm() 15895 667
ff 50 80 20 00 00 : 11111111 01010000 10000000 00100000 00000000 00000000


Elevator:

2016-09-13 00:24:20.555099 pulse_demod_pcm() 15896 1112
ff 18 50 20 00 01 : 11111111 00011000 01010000 00100000 00000000 00000001



Suite Door (to be):


ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000001

python code for decoding rtl_433 Analyzer output

 


def hex2b(h):
    return format(int(h,16),'0>8b')

def rtl_433_wl330a(dat):
    l = dat.split(' ')      # make a list of each byte
    l2 = map(hex2b, l[3:])  # remove header and convert to binary
    s = ''.join(l2)         # glue all bytes
    frl = s.split('111000') # split with frame header to have a list of frames
    rb = []
    rh = []
    for f in frl:
        if len(f) < 40:     # Skip if frame is less than 40 bits
            continue

        print f

        if f[0] != '1':     # Adjust frame if it's misaligned
            f = f[1:]
            print 'frame ajusted 1'
            if f[0] != '1':
                f = f[1:]
                print 'frame ajusted 2'
                if f[0] != '1': # Skip bad data
                    print 'Bad data'
                    continue
        r = []
        i=0
        last = len(f)
        try:
            while i < last:     # Convert 110 and 100 to 1 and 0
                if f[i] != '1' or f[i+2] != '0': # Check Star and stop bit
                        print 'Error in frame',f[i:i+3], i, f[i] != '1', f[i+2] != '0'
                        break

                r.append( f[i+1])   # append 2nd bit (that shows 1 or 0)
                i += 3
        except:
            pass
        s = ''.join(r)
        if not s:
            continue
        rb.append(s)
        print s                     # Print binary
        rh.append(hex(int(s,2)))
        print rh[-1]                # Print hex

Pulse Width Modulation with startbit/delimiter\n
OOK_PULSE_PWM_TERNARY

https://github.com/merbanan/rtl_433/blob/master/src/pulse_detect.c 

 
} else if(hist_pulses.bins_count == 3) {
  fprintf(stderr, "Pulse Width Modulation with startbit/delimiter\n");
  device.modulation	= OOK_PULSE_PWM_TERNARY;
  device.short_limit	= (hist_pulses.bins[0].mean + hist_pulses.bins[1].mean) / 2; // Set limit between two lowest pulse widths
  device.long_limit	= (hist_pulses.bins[1].mean + hist_pulses.bins[2].mean) / 2; // Set limit between two next lowest pulse widths
  device.reset_limit	= hist_gaps.bins[hist_gaps.bins_count-1].max +1; // Set limit above biggest gap
// Re-sort to find lowest pulse count index (is probably delimiter)
  histogram_sort_count(&hist_pulses);
  if	(hist_pulses.bins[0].mean < device.short_limit) { device.demod_arg = 0; } // Shortest pulse is delimiter
  else if	(hist_pulses.bins[0].mean < device.long_limit) { device.demod_arg = 1; } // Middle pulse is delimiter
  else	

------------------

case OOK_PULSE_PWM_TERNARY:
  data->gap[data->num_pulses-1] = device.reset_limit + 1; // Be sure to terminate package
  pulse_demod_pwm_ternary(data, &device);

https://github.com/merbanan/rtl_433/blob/master/src/pulse_demod.c
 

int pulse_demod_pwm_ternary(const pulse_data_t *pulses, struct protocol_state *device)
{
    int events = 0;
    bitbuffer_t bits = {0};
    unsigned sync_bit = device->demod_arg;
    for(unsigned n = 0; n < pulses->num_pulses; ++n) {
        // Short pulse
        if (pulses->pulse[n] < device->short_limit) {
            if (sync_bit == 0) {
                bitbuffer_add_row(&bits);
            } else {
                bitbuffer_add_bit(&bits, 0);
            }
        // Middle pulse
        } else if (pulses->pulse[n] < device->long_limit) {
            if (sync_bit == 0) {
                bitbuffer_add_bit(&bits, 0);
            } else if (sync_bit == 1) {
                bitbuffer_add_row(&bits);
            } else {
                bitbuffer_add_bit(&bits, 1);
            }
        // Long pulse
        } else {
            if (sync_bit == 2) {
                bitbuffer_add_row(&bits);
            } else {
                bitbuffer_add_bit(&bits, 1);
            }
        }
        // End of Message?
        if(pulses->gap[n] > device->reset_limit) {
            if (device->callback) {
                events += device->callback(&bits);
            }
            // Debug printout
            if(!device->callback || (debug_output && events > 0)) {
                fprintf(stderr, "pulse_demod_pwm_ternary(): %s \n", device->name);
                bitbuffer_print(&bits);
            }
            bitbuffer_clear(&bits);
        }
    } // for
    return events;
}
https://sigrok.org/wiki/MCU123_USBee_AX_Pro_clone

PIC16F505

I decided to use cheap logic analyzer I bought some years ago and never really tried.
https://sigrok.org/wiki/MCU123_USBee_AX_Pro_clone

I spent some time figuring out which software to use and how to configure the device, and finally succeeded in using with Sigrok Pulseview. (I used Windows Binary.)
https://sigrok.org/wiki/Main_Page

I first installed CyUSB3.sys driver, manually modifying Vendor end product ID, but possibly I didn't have to do this if I used Zadig to install WinUSB Driver for Sigrok from the beginning.
And it's well explained in the Sigrok Wiki.

I hooked up the GND and FSK Data pin from PIC16F505 and got something like this, after using higher sampling rate.

D0 is the Pin 10 (RC0) of PIC16F505 for FSK Data output. It goes to Pin 1 (FSKDTA) of TH72031.
D1 is pin 13 (RB0/ICSPDAT) on PIC16F505 and button input (after CR).
D2 is Pin 9 (RC1) on PIC and connected to Pin 4 (ENTX) of TH72031 FSK Transmitter.

So, when the button is pushed, I guess it waits and checks for the chattering and then triggers up ENTX to enable the transmitter (about 60 to 70ms for this).
Then, about 8ms after the ENTX and carrier wave starting, data is transmitted for about 1.2 second.

I tried to use different decoders bundled with Sigrok PulseView , but none of them was made for what we needed.
So, I used Timing, UART decoder to start guessing about the data.
[attachment=1]PIC16F505-chart2.png[/attachment]

It seems that the data bit is 160 micro seconds wide, and it roughly corresponds what we saw in rtl_433 output when we convert Hex string into binary form.

Hex: '00 00 00 00 00 00 07 1b 6d b6 d3 6d 26 d3 6d 24 92 69 24 92 49 24 92 49 24 dc 6d b6 db 4d b4 9b 4d b4 92 49 a4 92 49 24 92 49 24 93 71 b6 db 6d 36 d2 6d 36 d2 49 26 92 49 24 92 49 24 92 4d c6 db 6d b4 db 49 b4 db 49 24 9a 49 24 92 49 24 92'

Binary: '0000000000000000000000000000000000000000000000000000011100011011001001000010010000100100001001000010010000100100001001000010010000100100001001000010010000100110001001100011011000110110010010010100100101001001010010010100100101001001010010010100100101001001010010010100100101001001010011010100110101001101011010010110110101101101011011010110110101101101011011010110110101110001100100101001001010010010100100101001001010010010100100101001001010010010100100101001001010010011100110101001101110100100101101001011010010110100101101001011011010110110101101101100011011010010110100101101001111010011110110111101101111011011110110111101101111011100'

Bunch of zero is most probably caused by the waiting (warming up) period after ENTX is triggered and before the data was sent.

I wanted to check the binary data we got from rtl_433 against the data sent to FSKDTA.
So, I ended up writing a decoder module for WL300A/WL330A wireless doorbell for Sigrok.
These decoders are all written in Python, and relatively easy to understand and modify.

I used Timing decoder and modified to identify the data frame (150 bits, 24ms), containing start marker (6 bits '111000') and data field (3 bits each, either '110' or '100').
I guessed '110' and '100' are actually representing '1' and '0' (or the opposite).
[attachment=0]PIC16F505-chart5.png[/attachment]

After lots of learning and trial, I got the decoder going to my satisfaction, and got these data;

FSKDAT binary, after removing start marker ('111000') and translating '110' and '100' into '1' and '0':
'111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,111111110111001101110000001000000000000000000001,11111111011100110111000000100000000000000000000'

This contains 50 frames of 48 bits.
Each frame was identical (other than the last one), and it's Hex representation is: '0xff7370200001L'

I checked these against the data given by rtl_433, and they were not identical, although pretty similar.
Most probably, we need to specify correct sampling rate, etc to obtain better result.

With the sampling rate of 250000, I got slightly better, but mixed result.

./rtl_433.exe -f 916800000 -A -s 2500000

pulse_FSK_detect(): Maximum number of pulses reached!
Detected FSK package
Analyzing pulses...
Total count: 1200, width: 1489358 (595.7 ms)
Pulse width distribution:

[ 0] count: 1, width: 0 [ 0; 0] ( 0 us)

[ 1] count: 28, width: 1189 [1056;1208] ( 476 us)

[ 2] count: 445, width: 798 [776;886] ( 319 us)

[ 3] count: 726, width: 398 [381;408] ( 159 us)

Gap width distribution:

[ 0] count: 1, width: 20632 [20632;20632] (8253 us)

[ 1] count: 25, width: 1201 [1192;1227] ( 480 us)

[ 2] count: 449, width: 402 [392;441] ( 161 us)

[ 3] count: 722, width: 801 [715;816] ( 320 us)

[ 4] count: 2, width: 528 [512;545] ( 211 us)

Pulse period distribution:

[ 0] count: 1, width: 20632 [20632;20632] (8253 us)

[ 1] count: 25, width: 2399 [2395;2404] ( 960 us)

[ 2] count: 1169, width: 1201 [1118;1482] ( 480 us)

[ 3] count: 3, width: 890 [804;950] ( 356 us)

[ 4] count: 1, width: 1597 [1597;1597] ( 639 us)

Level estimates [high, low]: 15891, 523
Frequency offsets [F1, F2]: 426, -2971 (+16.3 kHz, -113.3 kHz)
Guessing modulation: Pulse Width Modulation with startbit/delimiter
Attempting demodulation... short_limit: 598, long_limit: 993, reset_limit: 20633 , demod_arg: 2
pulse_demod_pwm_ternary(): Analyzer Device
bitbuffer:: Number of rows: 25
[00] {1} 00 : 0
[01] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[02] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[03] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[04] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[05] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[06] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[07] {17} ff 73 00 : 11111111 01110011 0
[08] {30} c0 80 00 04 : 11000000 10000000 00000000 000001
[09] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[10] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[11] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[12] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[13] {17} ff 73 00 : 11111111 01110011 0
[14] {30} c0 80 00 04 : 11000000 10000000 00000000 000001
[15] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[16] {9} ff 00 : 11111111 0
[17] {38} cd c0 80 00 04 : 11001101 11000000 10000000 00000000 000001
[18] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[19] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[20] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[21] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[22] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[23] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000 001
[24] {214} ff 73 70 20 00 01 ff 73 70 20 00 01 ff 73 70 20 00 01 ff 73 70 20 00 01 ff 73 70

Header 1 1 1 0 1 1 ......
111 000 110 110 110 100 110 110 ......

RFM12B SP

RFM12B-S2 Wireless Transceiver -
https://www.sparkfun.com/products/12031

2.2-3.8VDC. An SPI interface is used to send data and configure the RFM12 module. The configuration commands, described in the RF12 IC Datasheet linked below, can be used to set the data rate, frequency band, wake-up timer, transfer data, receive data from the 16-bit FIFO, and much more.

The module comes in a 14-pin SMD package, with pins spaced by 2mm. Check below for a breakout board.

RFM12B library
http://www.das-labor.org/wiki/RFM12_library/en

definition, Type, Function
nINT/VDI, DI/ DO, Interrupt input (active low)/Valid data indicator
VDD, S, Positive power supply
SDI, DI, SPI data input
SCK, DI, SPI clock input
nSEL, DI, Chip select (active low)
SDO, DO, Serial data output with bus hold
nIRQ, DO, Interrupts request output（active low）
FSK/DATA/nFFS, DI/DO/DI, Transmit FSK data input/ Received data output (FIFO not used)/ FIFO select
DCLK/CFIL/FFIT, DO/AIO/DO, Clock output (no FIFO )/ external filter capacitor(analog mode)/ FIFO interrupts(active high)when FIFO level set to 1, FIFO empty interruption can be achieved
CLK, DO, Clock output for external microcontroller
nRES, DIO, Reset output（active low）
GND, S, Power ground

https://openenergymonitor.org/emon/buildingblocks/rfm12b-wireless

Antenna

433 1/4 wave = 164.7mm
433 1/2 wave = 329.4mm
433 full wave = 692.7mm

868 1/4 wave = 82.2mm
868 1/2 wave = 164.3mm
868 full wave = 345.5mm

915 1/4 wave = 77.9mm
915 1/2 wave = 155.9mm
915 full wave = 327.8mm

http://blog.strobotics.com.au/2008/01/08/rfm12-tutorial-part1/

http://blog.strobotics.com.au/2008/06/17/rfm12-tutorial-part2/

http://blog.strobotics.com.au/2008/06/23/rfm12b-bit-rates-and-throughput/

Sigrok decoder

https://sigrok.org/wiki/Protocol_decoder:Rfm12

Example case_

https://harizanov.com/2012/04/controlling-433mhz-rf-power-sockets-with-a-rfm12b-module/

IR protocol analyzer

http://ostan.cz/IR_protocol_analyzer/

http://www.sbprojects.com/knowledge/ir/index.php

Cross assembler for PIC, AVR
http://www.sbprojects.com/sbasm/

Tips and example codes

http://olek.tk/en/rfm12.php

Remote control (TX, RX)

http://jiggerjuice.info/electronics/projects/remotecontrol/remote-control-switch.html

https://lowpowerlab.com/2012/12/28/rfm12b-arduino-library/

http://bla.thera.be/article/high-level-avr-library-for-rfm12

German
http://www.mikrocontroller.net/articles/RFM12

Pylink
https://github.com/openenergymonitor/EmoncmsPythonLink

Receiver
https://github.com/stef/stm103-rfm12b/tree/master/python

Jeelabs
http://jeelabs.net/projects/cafe/wiki/Receiving_OOKASK_with_a_modified_RFM12B

Linux
https://github.com/gkaindl/rfm12b-linux
http://www.qdh.org.uk/wordpress/tag/fsk/

Wiring
https://openenergymonitor.org/emon/buildingblocks/rfm12b-wireless

Library

http://www.das-labor.org/wiki/RFM12_library/en

http://www.hansinator.de/rfm12lib/

Ethersex!
http://www.ethersex.de/index.php/RFM12_FSK

https://github.com/kpegan/Radio

./rtl_433.exe -f 916800000 -A -s 25000000 

 
Level estimates [high, low]:  15947,   1297
Frequency offsets [F1, F2]:   10692, -15431     (+40.8 kHz, -58.9 kHz)
Guessing modulation: Pulse Width Modulation with startbit/delimiter
Attempting demodulation... short_limit: 58, long_limit: 98, reset_limit: 2065, demod_arg: 2
pulse_demod_pwm_ternary(): Analyzer Device
bitbuffer:: Number of rows: 25
[00] {1} 00 : 0
[01] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000001
[02] {48} ff 73 70 20 00 01 : 11111111 01110011 01110000 00100000 00000000 00000001


Last modified : Tue Sep 13 09:37:00 2016 Maintained by nkom AT pico.dreamhosters.com