Hacking 433MHz RF link home automation

My project is to build a home wireless automation system. The system are going to interface existing infrastructure and new components like Arduino, Raspberry Pi, PIC microcontrollers and some new components and sensors. 433MHz RF link is a cheap and usefull wireless communication. This is what i bought on ebay:

The first task is to discover what those sensor are sending out. Since they are sending on 433MHz I bought some wireless senders and receivers:

I soildered a 17,3 cm long antenna on the devices and hooked the RX module up to my Arduino Uno port 2. Then I programmed my Arduino with the RCswitch example ReceiveDemo_Simple sketch and opened serial monitor in the Arduino programmer to see what the activated door sensor was sending out.

This is the message i got 10 times in my serial monitor :

Received 13981015 / 24bit Protocol: 1

Then I progammed my Arduino with RCswitch example ReceiveDemo_Advanced sketch and the message was  like this:


Decimal: 14112085 (24Bit) 
Binary: 110101110101010101010101 
Tri-State: 1FF1FFFFFFFF 
PulseLength: 542 microseconds 
Protocol: 1
Raw data: 16828,1596,564,1596,568,512,1652,1596,564,516,1648,1600,560,1600,564,1596,568,512,1648,1596,568,512,1652,1592,568,516,1648,1596,568,516,1648,1596,568,512,1652,1596,564,512,1652,1592,568,516,1652,1592,568,512,1656,1592,568,

The switches inside  the door sensor looked like this:

I moved one of the jumpers around and get different Tri-State messages in the Arduino serial monitor when I activated the sensor:

1 ............ L
2 ........|..| N
3 ........|..| H
  DDDDAAAAAAAA
  321076543210
Tri-State: 1FF1FFFFFFFF

1 ........|... L
2 ........|..| N
3 ...........| H
  DDDDAAAAAAAA
  321076543210
Tri-State: 1FF0FFFFFFFF

1 ............ L
2 |..........| N
3 |..........| H
  DDDDAAAAAAAA
  321076543210
Tri-State: 1FFFFFFF1FFF

1 ............ L
2 ...|.......| N
3 ...|.......| H
  DDDDAAAAAAAA
  321076543210
Tri-State: 1FFFFFFFFFF1

Then I moved the jumper marked: 1.5, 3.3, 4.7. This jumpers have inpact on the baud rate (bits pr second). This is the result:

Jumper set on 4.7 gives PulseLength: 542 microseconds 

Jumper set on 3.3 gives PulseLength: 373 microseconds 

Jumper set on 1.5 gives PulseLength: 177 microseconds 

The PulseLength is the single bit-length of the signal. This gives the baud rate of 1/PulseLength:
Jumper set on 4.7 gives baudrate of: 1845 bits/s
Jumper set on 3.3 gives baudrate of: 2680 bits/s
Jumper set on 1.5 gives baudrate of: 5649 bits/s

Inside the RCswitch.ccp file i found this:

/**
 * Sends a "1" Bit
 *                       ___  
 * Waveform Protocol 1: |   |_
 *                       __  
 * Waveform Protocol 2: |  |_
 */
/**
 * Sends a Tri-State "0" Bit
 *            _     _
 * Waveform: | |___| |___
 */
/**
 * Sends a Tri-State "1" Bit
 *            ___   ___
 * Waveform: |   |_|   |_
 */
/**
 * Sends a Tri-State "F" Bit
 *            _     ___
 * Waveform: | |___|   |_
 */
/**
 * Sends a "Sync" Bit
 *                       _
 * Waveform Protocol 1: | |_______________________________
 *                       _
 * Waveform Protocol 2: | |__________
 */

Each Tri-State consist of 8 bits.

I set the jumpers like this:

1 .......|.... L
2 .......|...| N
3 ...........| H
  DDDDAAAAAAAA
  321076543210
Tri-State: 1FFF0FFFFFFF


I run the pulses in Openbench Logic Sniffer, a logic analyzer for Arduino. The baud jumper is set to 4.7. With the waveforms above I was able to decode the signal, and I used a graphic app to draw the decoding into the puls schema.

Conclution
The jumpers A0-A7 is used to connect the sensor to a spesific central unit and the D0-D3 is used to separate different sensors connected to the central unit.

This should be enough to start developing my RF communication B)

To be continued.....

Usefull links:
http://tickett.wordpress.com/2012/06/27/more-433mhz-rf-hacking/
https://code.google.com/p/rc-switch/wiki/KnowHow_LineCoding
http://www.hkvstar.com/technology-news/how-to-program-wireless-detectors-to-alarm-system.html