Sunday, April 8, 2012

Achievement Unlocked: IM-ME Weather Station Receiver!

Ever have days like this?

I try to make it a habit not to talk about my job on this blog, but let's just say that the last three weeks have been pretty challenging.  Something came up late this week that made it look like a bomb would go off and blow my weekend all to hell.  I was certain this was going to happen and had resigned myself to busting ass this Easter long weekend instead of taking it easy.

But the bomb didn't go off.

Now, not only do I get to enjoy a long weekend, but I've also tacked on an extra day to give myself four days off.  That is three days longer than last weekend and four days longer than the weekend before.  To make things even better, the weather outside has been crappy.  That gave me the excuse I needed to do whatever the hell I felt like this weekend.  Manna from heaven, baby.
Manna Can Be What You Want It To Be
All this is good because I had a few things on my list that I wanted to get through.  The first item on the agenda was to eat a whole hell of a lot of cheesecake.  I've been trying to lose a few pounds over the last couple of months, and I've kept the idea of eating a cheesecake in mind the whole time as a reward.  My Lovely Wife doubled the recipe, so my cheesecake is the right half.
Before - My Half Is On The Right
After - Mission Accomplished
Now I'm no Cheesecake Master, but I did what I set out to do and packed this bad boy away in an evening.  And I was some full.  The detailed stats on this gluttony:
Weight: 1139 grams (2.5 lbs)
Calories: 3394 grams (not counting various toppings)
Fat: 188 grams
Carbohydrates: 332.6 grams
Protein: 84.3 grams
What I'm quite amazed by is that I stepped on the scale the next morning and my weight was exactly what it was the day before, despite all this food and despite pounding back a ton of water.  Yay me.  My Lovely Wife got the half on the left and did a bang up job of it too.  Let's just say that there isn't any of this taking up space in the fridge one day later.

The second item I had on my list for the weekend was making progress on using my Pretty Pink Pager as an alternative Davis Weather Station Console.  This was Goal #4 from the list of items I hoped to accomplish this year.  You might recall from my last blog post that  I had made some progress in decoding the data stream coming in from the Davis outdoor wireless Integrated Sensor Suite, and before that I had been able to sense the power coming from the ISS.  But it was still a pretty big step to go from what I had to getting real data.  And faithful readers of my blog (ha ha ha) might have noticed that I haven't posted for almost a month.  "Perhaps he fell into a cheesecake induced diabetic coma and died?", you may have wondered.

Well, wonder no more.  You see, the wheels of progress here at Mad Scientist Labs might grind slowly, but they grind fine.  I have been chipping away at this stuff for a long time and  finally have something worth showing.  Take a look!
Click To Embiggen
This photo shows my IM-ME perched on top of my laptop.  The STRMON output from my console is chugging away in a terminal in the background.  Note how the eight data bytes on the IM-ME display match the eight data bytes on the screen directly above.

Now I think that is pretty cool.

I first proposed that this might be possible back in January of last year, saying "It's so crazy, it just might work".  And you know what?  It works very well indeed.  Let's take a closer look.
This Took Forever To Get Right
Now here is what you are looking at:
  • Freq is pretty obvious.  Chan is the corresponding channel number from 0 - 50.
  • Data is the eight data bytes received from the ISS.  And guess what?  They come in Least Significant Bit first, and I have to reverse the bit order in my software.
  • CRC indicates if the check is OK or not.
  • LQI is the Link Quality Indicator.  The radio is kind enough to automatically collect this information for you and stick it onto the end of the packet if you ask it nicely.  It is an estimate of how easily the radio demodulated the last 64 symbols immediately following the sync word.  I don't have a good feel yet if "50" shown here is good or not.  About all I know is this is a 7-bit number, so I'm kind of in the middle of the range here.  It might get better if I clean up the offset (below).
  • RSSI is the Received Signal Strength Indicator.  Again, the radio sticks this onto the end of the packet for you.  The NOW value shows the current value and updates in a blur.  You can see that when the carrier came along, it was at a booming level well above that of the background noise.
  • OFFSET is an indication of how far you are off from the true center frequency of the signal.  It is actually the value in the FREQEST register that I grab after receiving the packet and setting the radio to idle.  This value is two's complement with a resolution of (Fref / 2^14), and that translates to around -13 kHz for the offset I have now.  I need to tune this in a bit, and I suspect that will improve the LQI number above.
I hit some funny problems as I went along.  Here are a few of the things I tripped over, keeping in mind that I don't do embedded firmware development for a living.  Or at all, for that matter.
  • I could not get interrupts to fire for the life of me.  I was triggering what should have been one from my code and... nothing.  Only accidentally did I trip over the CC1110's Global Interrupt Enable bit that is disabled by default.  I enabled that and interrupts starting working fine.
  • Davis got the bit order of the two sync bytes backwards from the manufacturer recommended 0xd3 0x91.  I had to tell the CC1110 to sync on 0xcb 0x89.
  • My RSSI reading was locking up at unpredictable times.  Turns out this is actually intended behavior.  I had my sync word detection set up to be very lax and the IM-ME was syncing on random noise.  As it says in the datasheet...
"In RX mode, the RSSI value can be read continuously from the RSSI status register until the demodulator detects a sync word (when sync word detection is enabled). At that point the RSSI readout value is frozen until the next time the chip enters the RX state."
I'm really happy to have gotten this far.  There was a lot of stuff I had to dig in to and reverse engineer to get to this point.  There is still lots to do, but I believe the remaining bits are relatively straightforward by comparison.  On my list:
  • Get this thing frequency hopping.  I just dwell on Channel 0 right now, but I know the sequence of hopping frequencies, and I have oodles of time to get from one channel to the next.  I don't know yet how the radio calculates what frequency to go to next, but I do have the raw frequencies, and that will do in a pinch.
  • Correct out the offset frequency.  TI is kind enough to publish a design note on how to do exactly this.
  • Actually check the CRC.  It always says OK right now.
  • Decode what all these data values mean and show them on a non-debug display.  I've gotten some help here and have also figured out a few things in a look at this a while back, so I think I can get a few of the basic things displayed quite easily.
  • Gracefully adapt between the 27 MHz oscillator in my IM-ME and the 26 MHz oscillator many other people have.  Some of the register settings are tied to the oscillator frequency.
  • Clean up the code.  It is a dog's breakfast right now.
I have just uploaded my code to github with a little "git push origin packetrx".  You can find the code here.  It compiles with sdcc via the magic incantation "make -f Makefile.pocketwx" on the packetrx branch.  If you happen to have an IM-ME and a GoodFET, you can then run "make -f Makefile.pocketwx install".  Like I said, the code is pretty ugly and disorganized right now, but you might find it useful if you are looking at doing a bit of fixed length packet reception stuff on an IM-ME or any other CC1110 based device.  There isn't much stuff out there on this right now that I could find.

Now I know what you are wondering.  The number of people with an IM-ME, the means to program it, and a Davis wireless weather station to listen in on are Quantity 1: me.  But let's think about this a little more.  Fine outfits like Archer Trading Post will sell you standalone ISS outdoor units that we now know we can build a compatible receiver around.  But you can't walk into a store to buy an IM-ME anymore and it isn't expandable.  That is where Ciseco comes in.  They will sell you a CC1110 based XRF module in an XBee form factor for the low low price of £9.90 and dirt cheap shipping. And yes, I already have one.  In fact, I might be the only person to ever order just one, as they are meant to be used in pairs.
XRF Module: TI's Development Kit is 41.3x More Expensive at $649
This all opens the door to building a pretty capable DIY, open source weather station console based on high quality commercial components to gather up the data.  Davis sells really good outdoor hardware for this, but their indoor stuff is limited, low powered, expensive, and doesn't feature the kind of connectivity to hook into something like Pachube very easily.  A little module like this brings a lot of capability to the table.  This is my long term goal and won't happen anytime soon, especially with summer coming up and having to shift my time to various landscaping projects.  But I do have a lot of fun playing around with it, and maybe things will move along faster if some other hardcore Davis weather fanatics decide to jump on board.

Before heading out, I would be remiss if I didn't thank a couple folks for helping me get this far.  It was Travis Goodspeed who first mentioned that the CC1110 in the IM-ME should be compatible with the CC1021 in the console.  Travis also designed the GoodFET, a board he literally gives away to further people digging in to stuff like this.  It is a must have for IM-ME hacking.  Then there is Joby Taffey, who wrote the PinkOS operation system for the IM-ME.  I wouldn't have stood a chance without this code to get me rolling.  And of course there is Michael Ossman who wrote the IM-ME based spectrum analyzer based on Dave's pioneering work.  I'd have been screwed without all the previous work from these guys because, as this picture shows, I'm not much of a programmer.
RIP Dennis M. Ritchie


  1. Awesome! Well done so far! Is this system is hopping or DSSS?

    It looks like somthing in the link is marginal, antennae or freq error(assuming RSSI is in dBm) -107dBm is pretty weak, assuming these units are very close together and non-hopping. Also the Link Quality Indicator instantaious values may be in NOW vs. RSSI values?

    I am definately impressed!

    1. Thanks b-wave and Météo.

      It is FHSS, not DHSS. See this post.

      The console uses an algorithm to figure out what frequency to hop to next based on the band and transmitter ID that we haven't figured out yet. But for a given band and ID, the hop sequence is always the same. I plan to get the IM-Me to hop based on the frequency values I have sniffed in the meantime.

      RSSI as shown is the raw value from one of the radio registers. It is not dBm, but the CC1110 datasheet does show how to calculate to dBm based on this register. I just wanted to see the relative difference from background noise to know that I was actually seeing a signal or not before I ever got the packet stuff working. BTW, I manually dialed in a compensation for the frequency offset and that didn't improve LQI.

  2. Hi,

    Impressive! Good on you for getting this far...

    I wish I had the time to help..

    Imagine my amazement to find that Ciseco are not only in the UK like me, but in the nearest town to me! (Technology in Leicester...There's hope yet)

    Please keep on going!!

  3. Hi DeKay, take a look at that:

    1. Interesting. Looks like someone has come up with an RS-422 sniffer. They must also have worked out the meaning of the raw data coming back from the station like I am playing with. Too bad they haven't made this information public (as far as I know).