Monday, May 28, 2018

rtl_433 DSC sensor bit decoding.

I'm finally going to submit a PR to rtl_433 to break out the DSC security sensor status bits.  I thought I'd post the proposed output here in case anyone wants to comment.  This is an update of my previous post: rtl_433 now decodes DSC 433 Mhz wireless securty contacts.

Sorry it has been nearly 3 years since I've posted the original. I've been using a Perl and later Python parser to analyze the messages.

A few notes:
  • The x*-bits are somewhat experimental.
  • Some bits, namely the "xactivity" bit are a little different depending on sensor manufacturer.
    • Some (4945) set the "xactivity" bit on event messages.
    • Others (4975) set the "xactivity" bit on the first heartbeat message *after* an event.  So it can be used to detect if an event transmission has been missed.
  • There are two bits that seem to indicate tamper,  I need to go back and check my logs a bit more carefully or run some additional experiments.  I think one represents the tamper status, the other is more of a event indicator.
    • The tamper field looks at both xtampe1 and xtamper2.
  • I won't include message type, that was an experiment to test a theory that 2-3 bits might trepresent a message type..
  • Let me know if you've seen status values other than what I have here or if you spot something I haven't.

Here's a summary of the proposed output:

$ ./
Most Common WS4945 (Open, Closed, Heartbeat Open, Heartbeat Closed)
0xa1 0b10100001 {"closed": false, "event": true, "battery_low": false, "tamper": false, "xmsgtype": 2, "xactivity": true, "xtamper1": false, "xtamper2": false}
0xa3 0b10100011 {"closed": true, "event": true, "battery_low": false, "tamper": false, "xmsgtype": 2, "xactivity": true, "xtamper1": false, "xtamper2": false}
0xc1 0b11000001 {"closed": false, "event": false, "battery_low": false, "tamper": false, "xmsgtype": 4, "xtamper1": false, "xtamper2": false}
0xc3 0b11000011 {"closed": true, "event": false, "battery_low": false, "tamper": false, "xmsgtype": 4, "xtamper1": false, "xtamper2": false}

Most Common EV-DW4975 (Open, Closed, Heartbeat Recent Open, Heartbeat Recent Closed)
0x81 0b10000001 {"closed": false, "event": true, "battery_low": false, "tamper": false, "xmsgtype": 0, "xtamper1": false, "xtamper2": false}
0x83 0b10000011 {"closed": true, "event": true, "battery_low": false, "tamper": false, "xmsgtype": 0, "xtamper1": false, "xtamper2": false}
0xe1 0b11100001 {"closed": false, "event": false, "battery_low": false, "tamper": false, "xmsgtype": 6, "xactivity": true, "xtamper1": false, "xtamper2": false}
0xe3 0b11100011 {"closed": true, "event": false, "battery_low": false, "tamper": false, "xmsgtype": 6, "xactivity": true, "xtamper1": false, "xtamper2": false}

Motion Detector 4904P (Tripped, Heartbeat, Not tripped)

Glass Break - Tripped, Heartbeat (not tripped), Not Tripped & Tamper, Heartbeat w Low Battery
0x82 0b10000010 {"closed": true, "event": true, "battery_low": false, "tamper": true, "xmsgtype": 0, "xtamper1": true, "xtamper2": false}
0xcb 0b11001011 {"closed": true, "event": false, "battery_low": true, "tamper": false, "xmsgtype": 4, "xtamper1": false, "xtamper2": false}
0x8a 0b10001010 {"closed": true, "event": true, "battery_low": true, "tamper": true, "xmsgtype": 0, "xtamper1": true, "xtamper2": false}
0x8b 0b10001011 {"closed": true, "event": true, "battery_low": true, "tamper": false, "xmsgtype": 0, "xtamper1": false, "xtamper2": false}
0x80 0b10000000 {"closed": false, "event": true, "battery_low": false, "tamper": true, "xmsgtype": 0, "xtamper1": true, "xtamper2": false}
0xf3 0b11110011 {"closed": true, "event": false, "battery_low": false, "tamper": true, "xmsgtype": 7, "xactivity": true, "xtamper1": false, "xtamper2": true}

Flood Detector (N.O.) - Heartbeat OK, Tripped, Heartbeat & Tamper,
0xc2 0b11000010 {"closed": true, "event": false, "battery_low": false, "tamper": true, "xmsgtype": 4, "xtamper1": true, "xtamper2": false}
0x92 0b10010010 {"closed": true, "event": true, "battery_low": false, "tamper": true, "xmsgtype": 1, "xtamper1": true, "xtamper2": true}
0x93 0b10010011 {"closed": true, "event": true, "battery_low": false, "tamper": true, "xmsgtype": 1, "xtamper1": false, "xtamper2": true}
0xa2 0b10100010 {"closed": true, "event": true, "battery_low": false, "tamper": true, "xmsgtype": 2, "xactivity": true, "xtamper1": true, "xtamper2": false}
0xe2 0b11100010 {"closed": true, "event": false, "battery_low": false, "tamper": true, "xmsgtype": 6, "xactivity": true, "xtamper1": true, "xtamper2": false}

 Here are the bitmask mappings used for the above:
  • 0x80 = Sync bit? Always on, Invalid if not?
  • 0x40 = Heartbeat Message (not an open/close event)
  • 0x20 = Activity ?? (usage varies between manufacturers)
  • 0x10 = Tamper, possibly tamper event/state change message, EOL missing?
  • 0x08 = Battery Low
  • 0x04 = ?? never seen set
  • 0x02 = Closed/"Ok"/"Restored"
  • 0x01 = No tamper/Case closed/EOL intact

1 comment:

mzac said...

This is really awesome! I wonder is there any way to port this to an Arduino or ESP8266 with a 433MHz RF module?