Feb 252015
 

Were I live, up against the foothills just east of the Rocky Mountains, the temperatures can vary wildly in a single day, 40F degree swings are common and 60F+ degree swings are not unheard of. For a while now I have been wanting to measure and record the temperature variations inside my house in response to temperature swings outside the house. I want at least one temperature probe outside, another in the attic, one in the lower level on a north wall, one in each of the kids rooms, just to see if it is as cold as they complain it is, and maybe one in the garage. I’m talking about at least six probes. They should be wireless for ease of installation and the ability to talk to a remote base station where I can record the temperatures. I want to record the temperature over time so I need a computer interface of some kind. A web page displaying the results would be nice. Maybe push the results to an online data warehouse. Opportunities for fun are endless.

All of the pieces to build a system like this are readily available from the usual suspects, sparkfun, adafruit, ebay, dx, etc. Figure a temperature sensor, micro-controller, wireless module, battery case, wiring, etc. at each location, times six. I can find a temperature sensor for about fifty cents, Arduino mini for five bucks, wireless module for a buck fifty to three bucks, a case and miscellaneous parts for another two bucks, say a round $10 USD per node. Probably a RasPi for the base station, another $45 at least with power supply, case, and wireless receiver. And then I would have to put it all together and blah blah blah, I never got around to it.

The other day I was at Walmart and stumbled on a pile of wireless remote temperature base stations and probes in the clearance bin.

Acurite00771W front

When I flipped the package over I noticed the probe uses 433 MHz wireless to communicate with the base station. I know a lot of low end consumer wireless devices sourced out of China use a wireless module separate from the core logic of the device. Decoupling the wireless functionality from the core functionality makes a product more amenable to delivering to a worldwide market. Different parts of the world have different regulations on wireless transmissions so modularizing the wireless link allows it to be swapped out for different markets with minimal design and manufacturing changes.

Acurite00771W back

If the core and wireless functions were separate there was a possibility I could sniff the communication lines between the two and decode the data protocol. Once decoded I should be able tap the lines and record the received temperature data with an Arduino or RasPi.

A base station plus probe was on clearance at just under $10 USD, I quickly picked up three. If the probe and base station were designed like I expected $10 seemed like a steal, I couldn’t even build the probe for $10, let alone have the base station along with it.

Acurite00771W receipt

Here is the base station and probe out of the packaging. My first impression is good. The buttons are clicky, the probe looks reasonably robust, the display is big enough to be useful.

Acurite00771W_03s

Removing the battery covers reveals that the probe takes 2 AA alkaline batteries and the base station 3 AA batteries. There is also a backup battery under a cover in the base station to keep time when the main batteries are being changed.

Under the battery cover in both the base station and the probe is a slide switch labeled A, B, C. I’m assuming the switch allows you to have up to three base stations and three probes in the same radio range.

Now was the moment of truth, time to open them up and see what the radio infrastructure looks like. First remove the two screws under the batter cover, shown just above. Next remove the three rubber feet from the bottom of the probe and remove the three screws found there.

Pop off the base plate and then pry the shell in two.

Acurite00771W_10s

Flipping open the base station revealed the gold! There is clearly a wireless module mounted at the top of the unit, with the blue antenna wire leading out of it and running around the inside of the case.

Acurite00771W_11s

As an added bonus the wireless module is completely separate from the logic board. The two boards are connected by a four wire ribbon cable.

Acurite00771W_13s

Even better, the cable between the boards is labeled, SH, D, V, G (click the image to enlarge). V and G seem obvious, D is probably data, SH could be anything but a reasonable guess might be chip select or data available.

Acurite00771W_12s

Popping open the probe revealed a similar construction, a wireless module near the top of the unit connected to a logic board with four wires.

Acurite00771W probe open

Acurite00771W_15s

Acurite00771W_16s

Putting batteries in the unit caused it to power up and within a few minutes it was displaying the temperature. Everything seemed to be working, the remote sensor was being read by the base station, it was time to start probing around to see what I could see.

Acurite00771W_20s

Step one is check the power, get an idea of what we are working with. As expected with three alkaline batteries the voltage going to the logic board was around 4.5 ~ 4.8 volts DC.

I confirmed connectivity between the ribbon cable ground (G) and the battery ground, that one seemed obvious and was.

Acurite00771W_24s

Next I probed the V pin between the logic board and the wireless module, a reasonable guess is the V pin is voltage into the wireless module. The V pin turned out to be a solid 3.25 volts, let’s call it 3.3 volts because that’s what it probably is supposed to be.

Next thing to do was unscrew the wireless module, unwrap the antenna, and get a better look at the board.

Acurite00771W_30s

A macro shot of the main chip on the wireless module revealed it to be a MICRF211, a 3V 433.92 MHz Receiver,

MICRF211 datasheet 1

MICRF211 datasheet 2

The next step was to probe the lines with an oscilloscope and see what the signals between the wireless module and the logic board looked like. This was where the rubber meets the road, if the signals were anything crazy the pain to condition and decode them might not be worth it.

Only one way to find out, start poking and probing and see what you see.

Acurite00771W_32s

I started with the SH line.

Acurite00771W_33s

It turned out to be pretty boring. It was clearly a gate or data available line. Nothing very interesting. The voltage was right around 3 volts.

Acurite00771W_34s

Time to probe the D line and see if it was more interesting.

Acurite00771W_35s

Probing the D line was way more interesting, something was happening here. The reasonable theory is this is the data being transmitted from the probe to the base station. The signal level is again around 3.3 volts, so no special conditioning required here. The fastest pulse found was on the order of a few micro-seconds, not slow, but not crazy fast either, something I could get a hold of with an Arduino.

Acurite00771W_36s

Putting both traces on the scope at once clearly shows the gating or data ready behavior of the SH line overlapping the D line.

Acurite00771W_37a

Acurite00771W_37b

Now that I know what is in the case and what the data signals look like between the logic board and the wireless module the next step is to decode the data stream and see if it looks like something I can read and decode with everyone’s favorite microcontroller.

Part 2 of this post can be found here.

Acurite 00754 / 00771W / 00772W / 00773W / 00774W / 00592 / 00592TX

  6 Responses to “Hacking the Acurite 0077XW / 00592TX Wireless Remote Temperature Probe – Part 1 – hacking the hardware”

  1. […] [bhunting] lives right up against the Rockies, and for a while he’s wanted to measure the temperature variations against the inside of his hour against the temperature swings outside. The sensible way to do this would be to put a few wireless temperature-logging probes around the house, and log all that data with a computer. A temperature sensor, microcontroller, wireless module, battery, case, and miscellaneous parts meant each node in the sensor grid would cost about $10. The other day, [bhunting] came across the exact same thing in the clearance bin of Walmart – $10 for a wireless temperature sensor, and the only thing he would have to do is reverse engineer the protocol. […]

  2. […] [bhunting] lives right up against the Rockies, and for a while he’s wanted to measure the temperature variations against the inside of his hour against the temperature swings outside. The sensible way to do this would be to put a few wireless temperature-logging probes around the house, and log all that data with a computer. A temperature sensor, microcontroller, wireless module, battery, case, and miscellaneous parts meant each node in the sensor grid would cost about $10. The other day, [bhunting] came across the exact same thing in the clearance bin of Walmart – $10 for a wireless temperature sensor, and the only thing he would have to do is reverse engineer the protocol. […]

  3. […] [bhunting] lives right up against the Rockies, and for a while he’s wanted to measure the temperature variations against the inside of his house against the temperature swings outside. The sensible way to do this would be to put a few wireless temperature-logging probes around the house, and log all that data with a computer. A temperature sensor, microcontroller, wireless module, battery, case, and miscellaneous parts meant each node in the sensor grid would cost about $10. The other day, [bhunting] came across the exact same thing in the clearance bin of Walmart – $10 for a wireless temperature sensor, and the only thing he would have to do is reverse engineer the protocol. […]

  4. […] [bhunting] lives right up against the Rockies, and for a while he’s wanted to measure the temperature variations against the inside of his house against the temperature swings outside. The sensible way to do this would be to put a few wireless temperature-logging probes around the house, and log all that data with a computer. A temperature sensor, microcontroller, wireless module, battery, case, and miscellaneous parts meant each node in the sensor grid would cost about $10. The other day, [bhunting] came across the exact same thing in the clearance bin of Walmart – $10 for a wireless temperature sensor, and the only thing he would have to do is reverse engineer the protocol. […]

  5. Excellent article! Very interesting to read.

 Leave a Reply

To create code blocks or other preformatted text, indent by four spaces:

    This will be displayed in a monospaced font. The first four 
    spaces will be stripped off, but all other whitespace
    will be preserved.
    
    Markdown is turned off in code blocks:
     [This is not a link](http://example.com)

To create not a block, but an inline code span, use backticks:

Here is some inline `code`.

For more help see http://daringfireball.net/projects/markdown/syntax

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)