It is now the Christmas break and I've got a bit of time on my hands. I have been bugged for some time by the fact that my Davis Vantage Pro 2 Wireless weather station is not very hacker friendly. Maybe it is time to change that. It is out of warranty now and I decided to open it up to see what makes this thing tick.
This is the guts of the VP2 Wireless Console. The controller board is on the left and the display to the right. The controller board PCB is just double-sided, and contains contact pads for the buttons on the other side. The bottom part of the unit is where the batteries normally go. There are just three screws holding the back on and it comes off pretty easily. One thing you'll want to do before trying this is to put the console into config mode by hitting the Done button and then Down Arrow. According to the manual, this ensures that the unit isn't trying to write to flash before it loses power. And it will lose power. The AC adapter has to be pulled before the back can come off, and the batteries make connection to the main board with just a couple of clips rather than a set of wires. Losing power is no big deal though: the unit remembers its settings once power is restored again. Nice.
|
And no "Warranty Void if Sticker Removed" nonsense either |
The first thing I noticed is that the CPU is an Atmel ATMEGA 128L running at 1.8432 MHz. I was afraid it might have some kind of a custom processor or something to keep power consumption low. But you don't get more common than an ATMEGA chip, and there are a lot of freely available tools out there that should simplify digging into this.
|
Oh, you and I are going to get to know each other a lot better soon. |
The second thing I noticed was the radio transceiver chip. Again, I feared something custom here. But it turns out that this is a CC1021 from Texas Instruments (
data sheet). TI describes it as a "true single-chip UHF transceiver designed for very low power and very low voltage wireless applications." Sounds about right. Hanging off of it is a 833 MHz crystal. Anywhere I've read about people trying to decode the transmissions from the station were always put off by Davis' "frequency hopping spread spectrum" advertising. This is much more advanced than the old FSK method they used. But hey, if you know the transceiver and you know how it is set up, then that opens up some interesting possibilities.
|
You don't scare me. I do RF all day at work. |
The one thing I don't care about much is the LCD. It is apparently a custom unit built by
Ocular LCD labeled A4144PCB-2. It doesn't appear on their website (that I could find after 20 seconds of looking anyway).
So the next thing I'm planning to do is order up a
Bus Pirate. This will let me sniff the SPI interface between the Atmega and the transceiver to see how they are configuring it. While that is in transit, I want to beep out the connection between these two chips, and the connection between the CPU and the expansion interface. Davis also makes the CPU firmware available, and I might take a shot at building up an emulator so I could figure out how the raw data from the radio gets processed and put out to the interface. One day it might be possible to
- interface to the VP2 console without buying Davis' crappy Weatherlink software
- build a standalone receiver around a CC1021 and something like an Arduino. This would give me a low cost receiver with a proper computer interface.
Some pretty cool possibilities here.
PS. If anybody knows what this is, please leave a comment.