text: Reversing the SPC315 Temperature Probe Protocol | Hackaday.io
  Back in 2006, I gave this clock with remote temperature sensor to my mom for Mother's Day. It has worked great for many years, only needing the batteries to occasionally be charged. However, the temperature sensor quit working about two years ago. Since I was looking for a good beginner-level electronics project, I decided to reverse engineer the probe's protocol and build my own sensor to replace it.
  I started work on this about two years ago when the clock stopped picking up the temperature sensor's signal. I searched to see if anyone had created a library for it, but did not find any. A search for the transmitter's FCC ID did result in what appeared to be the original manufacturer's filing, including a block diagram, signal timing diagram, schematic, and other documentation.
  Since there were no existing libraries that I could find, I took advice from some forum postings of people in a similar position as myself and began to make recordings of its transmissions. I created a spreadsheet in LibreOffice Calc where raw binary transmissions and their corresponding temperature readings could be stored and visualized. I then found a place on the transmitter's PCB where I could solder a wire to capture its signal with my oscilloscope. At the time I only had a DSO138 oscilloscope so this quickly became frustrating and the project was shelved.
  Temperature transmitter, with my oscilloscope leads connected. Thermistor has been replaced with three 10K resistors and a 10K potentiometer so I could easily simulate a negative temperature.
  My father got me a Tektronix oscilloscope for Christmas, which didn't arrive until earlier this month. It renewed my interest in this project and has allowed me to easily capture and record the signals from this transmitter.
  A complete capture of the signal from the temperature transmitter. This is recording #008 in my table.
  The documentation from the FCC site helped me make sense of the signals. It told me the device used on-off keying (OOK) and binary-coded decimal (BCD) to encode the temperature. With this information, I was able to quickly locate the temperature. After making additional recordings with the "channel" switch in different positions the channel ID became apparent as well. To isolate the battery low indicator, I powered the transmitter off of my bench power supply and made a few recordings with the voltage set to about 2.27 V. During this time I also noticed there appears to be a 6 bit randomly generated ID that changes anytime the transmitter is reset.
  It was apparent after the first few recordings that what the transmitter was actually sending differed greatly from the example provided by the manufacturer in their FCC filing. Despite this, I went with what the example said and assumed the 8 bits following the temperature were a placeholder for humidity even though my transmitter has the humidity sensor omitted. Below is a picture of my Calc spreadsheet at this point in time with the manufacturer's example below it for comparison:
  A table of actual transmissions from the temperature probe, with the manufacturer's example they gave the FCC below.
  Seeing that I only had 32 bits at the end to figure out, I assumed this was a CRC checksum and began to run CRC RevEng on the last four transmissions to figure out what it was. After trying it with many different parameters and omitting different combinations of bits off the front of the signal, I began to suspect that part of the checksum was not a CRC at all. This suspicion was further fueled by the difference in appearance of the left and right halves of the checksum data.
  I returned to Google and found where other temperature probes included a XOR of the payload data as part of their checksum. After staring at my spreadsheet for some time, I found where my transmitter contained a XOR in its checksum as well. With this new discovery, I arrived at the current version of my spreadsheet:
  This image shows my current understanding of the temperature sensor's signal.
  I again proceeded to run many combinations of data and parameters through CRC RevEng, but I have not yet been able to figure out the CRC.
  Signal Spreadsheet.ods
  Table of recorded transmissions from the temperature sensor, with known contents labeled.
  spreadsheet - 24.01 kB - 02/15/2021 at 22:37
  Microwave control through temperature and Android
  Microwave Intelligent
  You are about to report the project "Reversing the SPC315 Temperature Probe Protocol", please tell us the reason.