The Fine Offset weather station switched over to a new RF transmission protocol somewhere in 2012. While the old protocol was a On-Off-Keying (OOK) protocol, the V2 protocol used Frequency-Shift-Keying (FSK). This is natural transmision mode of the RFM02 transmitters and their RFM01 receivers. The RFM12B modules can also receive the same FSK signals. Most of the reverse engineering happened on the Raspberry Pi forum: WH1080 V2 protocol decoded
This post details on the exact transmission protocol.
Package definition:
[
preample 3 bytes 0xAA synchron word payload 10 bytes postample 11bits zero
0xAA 0xAA 0xAA 0x2D 0xD4 nnnnn---nnnnnnnnn 0x00 0x0
101010101010101010101010 0010110111010100 101.............. 00000000 000
]
repeated six times (identical packages) per transmission every 48 seconds
There is no or hardly any spacing between the packages.
Spacing: to be confirmed.
When using the RFM01 or RFM12B, the preample and synchron word will not be in the received data. The preamble is intended to have the frequency synthesiser locked, while the synchron word serves as detection of the proper message.
Open issue: How can an end-of-transmission be detected? Would VDI turn into zero?
The payload contains to types of messages for FO WH1080, and relatives:
Payload definition:
Weather sensor reading Message Format:
AAAABBBBBBBBCCCCCCCCCCCCDDDDDDDDEEEEEEEEFFFFFFFFGGGGHHHHHHHHHHHHIIIIJJJJKKKKKKKK
0xA4 0xF0 0x27 0x47 0x00 0x00 0x03 0xC6 0x0C 0xFE
10100100111100000010011101000111000000000000000000000011110001100000110011111110
with:
AAAA = 1010 Message type: 0xA: sensor readings
BBBBBBBB Station ID / rolling code: Changes with battery insertion.
CCCCCCCCCCCC Temperature*10 in celsius. Binary format MSB is sign
DDDDDDDD Humidity in %. Binary format 0-100. MSB (bit 7) unused.
EEEEEEEE Windspeed
FFFFFFFF Wind gust
GGGG Unknown
HHHHHHHHHHHH Rainfall cumulative. Binary format, max = 0x3FF,
IIII Status bits: MSB b3=low batt indicator.
JJJJ Wind direction
KKKKKKKK CRC8 - reverse Dallas One-wire CRC
DCF Time Message Format:
AAAABBBBBBBBCCCCDDEEEEEEFFFFFFFFGGGGGGGGHHHHHHHHIIIJJJJJKKKKKKKKLMMMMMMMNNNNNNNN
Hours Minutes Seconds Year MonthDay ? Checksum
0xB4 0xFA 0x59 0x06 0x42 0x13 0x43 0x02 0x45 0x74
with:
AAAA = 1011 Message type: 0xB: DCF77 time stamp
BBBBBBBB Station ID / rolling code: Changes with battery insertion.
CCCC Unknown
DD Unknown
EEEEEE Hours, BCD
FFFFFFFF Minutes, BCD
GGGGGGGG Seconds, BCD
HHHHHHHH Year, last two digits, BCD
III Unknown
JJJJJ Month number, BCD
KKKKKKKK Day in month, BCD
L Unknown status bit
MMMMMMM Unknown
NNNNNNNN CRC8 - reverse Dallas One-wire CRC
The DCF code is transmitted five times with 48 second intervals between 3-6 minutes past a new hour. The sensor data transmission stops in the 59th minute. Then there are no transmissions for three minutes, apparently to be noise free to acquire the DCF77 signal. On similar OOK weather stations the DCF77 signal is only transmitted every two hours.
The package format was deduced using a long transmision buffer on a JeeNode with some modificaitons in the RF12 driver.
The payload definitions have been described at those pages:
WH1080 V1 OOK protocol
WH1080 V2 FSK protocol
WH1080 V1 OOK and DCF77 message format
This applies at least to the following (later) models:
Fine Offset WH1080
Alecto WS4000
National Geographic 265, at 916MHz