search

merbanan / rtl_433

Program to decode radio transmissions from devices on the ISM bands (and other frequencies)
GNU General Public License v2.0
5.92k stars 1.3k forks source link

Support for Quinetic 433Mhz Button #2267

Open pazzernick opened 1 year ago

pazzernick commented 1 year ago

Hi,

Firstly, thanks for the fantastic rtl_433 tooling. Amazing work!

I'm trying to add support for a kinetic-powered switch, which is typically 'paired' via RF to one or more receivers such as Smart Plugs, Lighting Relay, etc. Model: Quinetic QUGDMK

I've demodulated the samples in Universal Radio Hacker and think I've found the data...

Signal Characteristics:

Command used to capture samples ( antenna attached to R820T )

rtl_433 -s 2048000 -R 0 -Y autolevel -Y squelch -g 20 -S unknown

Analysis output:

# rtl_433 -s 2048000 -R 0 -A button_11_g003_433.92M_2048k.cu8

rtl_433 version 22.11-9-g6e1f1202 branch master at 202211291952 inputs file rtl_tcp RTL-SDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Disabling all device decoders.
Registered 0 out of 223 device decoding protocols [ ]
Test mode active. Reading samples from file: button_11_g003_433.92M_2048k.cu8
Detected OOK package    @0.738655s
Analyzing pulses...
Total count:    3,  width: 8.11 ms      (16604 S)
Pulse width distribution:
 [ 0] count:    3,  width: 1313 us [1308;1321]  (2690 S)
Gap width distribution:
 [ 0] count:    2,  width: 2083 us [2083;2083]  (4266 S)
Pulse period distribution:
 [ 0] count:    2,  width: 3399 us [3395;3404]  (6962 S)
Pulse timing distribution:
 [ 0] count:    3,  width: 1313 us [1308;1321]  (2690 S)
 [ 1] count:    2,  width: 2083 us [2083;2083]  (4266 S)
 [ 2] count:    1,  width: 13213 us [13213;13213]   (27061 S)
Level estimates [high, low]:   1000,      9
RSSI: -12.1 dB SNR: 20.5 dB Noise: -32.6 dB
Frequency offsets [F1, F2]:     941,      0 (+29.4 kHz, +0.0 kHz)
Guessing modulation: Un-modulated signal. Maybe a preamble...
view at https://triq.org/pdv/#AAB10305210823339D81818255

Failing flex command:

# rtl_433 -s 2048000 -R 0 -Y minmax -X "name=Quinetic,m=FSK_PCM,s=10,l=10,r=600,t=1" button_11_g003_433.92M_2048k.cu8

rtl_433 version 22.11-9-g6e1f1202 branch master at 202211291952 inputs file rtl_tcp RTL-SDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Disabling all device decoders.
Registered 1 out of 223 device decoding protocols [ ]
Test mode active. Reading samples from file: button_11_g003_433.92M_2048k.cu8
baseband_demod_FM: low pass filter for 2048000 Hz at cutoff 409600 Hz, 2.4 us
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : @0.738655s
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 124          data      : 02aaaaaaaaa10d2118dc380985826b4
codes     : {124}02aaaaaaaaa10d2118dc380985826b4

quinetic_button11_button12.zip

Any help in identifying the signal / flex-config would be greatly appreciated....

zuckschwerdt commented 1 year ago

That looks like a pretty fast signal, naturally as there is not much time/energy to transmit. The bit width is 10 µs (100 kBps), which is why you need a high sample rate.

This should work: rtl_433 -Y minmax -R 0 -X 'n=name,m=FSK_PCM,s=10,l=10,r=90'

Unlikely the correct preamble/sync, but you can for now sync on 5554 to get aligned codes, e.g. ,preamble=5554 Looks like about 80 bits payload.

pazzernick commented 1 year ago

Thanks for the suggestion. In URH, my payload looks to be 70 bits in length.

With the suggested flex config I get 2 different lengths of data. Button-11 is showing 79 and Button-12 is showing 45.

Button 11

rtl_433 -s 2048000 -R 0 -Y minmax -X "name=Quinetic,m=FSK_PCM,s=10,l=10,r=90,preamble=5554" button_11_g003_433.92M_2048k.cu8

rtl_433 version 22.11-9-g6e1f1202 branch master at 202211291952 inputs file rtl_tcp RTL-SDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Disabling all device decoders.
Registered 1 out of 223 device decoding protocols [ ]
Test mode active. Reading samples from file: button_11_g003_433.92M_2048k.cu8
baseband_demod_FM: low pass filter for 2048000 Hz at cutoff 409600 Hz, 2.4 us
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : @0.738655s
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a4231b870130b04d68
codes     : {79}21a4231b870130b04d68

Button 12

rtl_433 -s 2048000 -R 0 -Y minmax -X "name=Quinetic,m=FSK_PCM,s=10,l=10,r=90,preamble=5554" button_12_g003_433.92M_2048k.cu8 

rtl_433 version 22.11-9-g6e1f1202 branch master at 202211291952 inputs file rtl_tcp RTL-SDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Disabling all device decoders.
Registered 1 out of 223 device decoding protocols [ ]
Test mode active. Reading samples from file: button_12_g003_433.92M_2048k.cu8
baseband_demod_FM: low pass filter for 2048000 Hz at cutoff 409600 Hz, 2.4 us
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : @0.651895s
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 45           data      : 21a423b69000
codes     : {45}21a423b69000

I'm not sure how the 'reset=90' is derived, can you give me a hint on how to tune it, or should I leave it alone?

If I'm not barking up the wrong tree, I believe this is the Hex data from Button 11. I guess that's what I'm expecting to see in rtl_433

fffe6666666666666666666018079860181e079f807e00061e019e0061e67986080 [Pause: 4224 samples]
f7f333333333333333333300c03cc300c0f03cfc03f00030f00cf0030f33cc3060 [Pause: 4224 samples]
ffe8ccccccccccccccccccc0300f30c0303c0f3f00fc000c3c033c00c3ccf30c1a [Pause: 43478 samples]
zuckschwerdt commented 1 year ago

With the suggested flex config I get 2 different lengths of data. Button-11 is showing 79 and Button-12 is showing 45.

I didn't check how many consecutive 0-bits are expected, use r=200 then. Basically you want to go slightly bigger than the longest expected gap, e.g. a byte of 0's and some margin gives 90. Reasonable protocols use bit-stuffing, whitening, or such to limit the number of consecutive symbols -- but that's no used here apparently.

Hex data from Button 11. I guess that's what I'm expecting to see in rtl_433

That does not look valid, all your symbols are multiples of length 2. Maybe you mismatched sample rate and bit length?

pazzernick commented 1 year ago

I may have answered my own question... using reset=120, I have similar data lengths now. Hopefully I can extract some differences to detect the Switch UID.

Button 11

rtl_433 -s 2048000 -R 0 -Y minmax -X 'name=Quinetic,m=FSK_PCM,s=10,l=10,r=120,preamble=5554' button_11_g003_433.92M_2048k.cu8 
rtl_433 version 22.11-9-g6e1f1202 branch master at 202211291952 inputs file rtl_tcp RTL-SDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Disabling all device decoders.
Registered 1 out of 223 device decoding protocols [ ]
Test mode active. Reading samples from file: button_11_g003_433.92M_2048k.cu8
baseband_demod_FM: low pass filter for 2048000 Hz at cutoff 409600 Hz, 2.4 us
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : @0.738655s
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a4231b870130b04d68
codes     : {79}21a4231b870130b04d68

Button 12

rtl_433 -s 2048000 -R 0 -Y minmax -X 'name=Quinetic,m=FSK_PCM,s=10,l=10,r=120,preamble=5554' button_12_g003_433.92M_2048k.cu8 
rtl_433 version 22.11-9-g6e1f1202 branch master at 202211291952 inputs file rtl_tcp RTL-SDR
Use -h for usage help and see https://triq.org/ for documentation.
Trying conf file at "rtl_433.conf"...
Trying conf file at "/usr/local/etc/rtl_433/rtl_433.conf"...
Trying conf file at "/etc/rtl_433/rtl_433.conf"...
Disabling all device decoders.
Registered 1 out of 223 device decoding protocols [ ]
Test mode active. Reading samples from file: button_12_g003_433.92M_2048k.cu8
baseband_demod_FM: low pass filter for 2048000 Hz at cutoff 409600 Hz, 2.4 us
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : @0.651895s
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a423b69000aacca6b48
codes     : {83}21a423b69000aacca6b48
pazzernick commented 1 year ago

I'm just preparing .cu8 sample files for rtl_433_tests

To keep the samples small, I'm trying to open and edit/crop them. However in Universal Radio Hacker I can only save out to .complex16

Can you advise on which app might be suitable for exporting / direct-edit of .cu8?

So far, I've only been using URH, and my decoding was way-off. Hence, I'm still looking for a method to demodulate the FSK signals outside of rtl_433. Will pulseview handle this?

merbanan commented 1 year ago

You can use dd to split out relevant sections. Use -W to let rtl_433 to do the demodulation of FSK data.

zuckschwerdt commented 1 year ago

There is one more option to split/crop cu8 files soon: pdv will get a "save as" feature. There is a (bare bones) preview at https://triq.org/spectrogram-next/

pazzernick commented 1 year ago

Thanks chaps.

@merbanan - when you state to use '-W' I guess you mean to open with Pulseview? I've done that, but still not sure how to demodulate or see the final data. The Pulseview manual is offline at the moment, so I'm just poking around to find examples of FSK PCM demodulation. I'm not 100% sure which decoder to use... OOK seems to fail.

I checked out the content of the .sr zip-file and there isn't any stash of demodulated data there. I'm guessing I just need to learn Pulseview.

When using https://triq.org/pdv/ with the PCM data, I'm can't find the right settings to demod the data either, but I presume that with the correct 'sync' that might be possible.

merbanan commented 1 year ago

The PV stuff is just for visualization. To get the bits you need to use rtl_433. I think you have to share a sample to get any better advice from me.

pazzernick commented 1 year ago

OK, thanks for confirming...

There are 4 zipped samples on the first post, if you can shed any light on how I might get the online PDV to work with these PCM samples.

The flex-config I'm testing with is below. It's 95% working, but cannot handle the occasional payload which is "too short", e.g. 4th pulse from switch, which is frequently useless and just needs ignoring.

That is why I'm hoping to start on ./src/devices/quinetic.c shortly, so the payload can be checked.

# Sample Data:
#
#       Button X
# 21 a4 23 1b 87 01 30 b0 4d 68 (PUSH)
# 21 a4 23 1b 87 c0 7c ee a6 b4 80 (RELEASE)
#
#       Button Y
# 21 a4 23 b6 90 00 aa cc a6 b4 8 (PUSH)
# 21 a4 23 b6 90 c0 9c f4 4d 69 0 (RELEASE)
#
#

decoder {
    name=Quinetic,
    modulation=FSK_PCM,
    short=10,
    long=10,
    reset=120,
    tolerance=2,
    match={24}0x21a423,
    preamble=5554,
    get=id:@24:{16},
    get=action:@40:{4}:[0:Push 12:Release],
}
zuckschwerdt commented 1 year ago

Are the IDs printed somewhere on the device or known from some receiver, and shouldn't that be 32 bit? Do you know which part of 21 a4 23 is a sync word /type /model code? The changes from push to release seem random, is it encrypted? Is there a 2-way pairing? Are all push messages the same or do some bits always keep changing?

pazzernick commented 1 year ago

Are the IDs printed somewhere on the device or known from some receiver, and shouldn't that be 32 bit?

I presumed it would be 32-bit, but really not sure. Each device has a numeric value on a barcode-label. It may include the ID, but I cannot be certain...

Value mappings:

Button 11
codes     : {79}21a4231b870130b04d68
label     : EBM1202206181272

Button 12
codes     : {83}21a423b69000aacca6b48
label     : EBM1202206181263

Do you know which part of 21 a4 23 is a sync word /type /model code?

I haven't got a clue, but I have 2 physically separate switches, both sharing the leading 24-bits 21 a4 23. I have 10 other switches at another site, so can surely check for further variations. However, they are all the same model.

My objective of the day is to demodulate this accurately so that I can answer your question about the sync word... ;-)

The changes from push to release seem random, is it encrypted?

I'm stabbing in the dark, but made a guess that bit 40 is relating to the PUSH vs RELEASE.

When doing repeated physical testing, the changes on bit 40 seem to be consistent, e.g. when bit40 is 0, it seems to be push rather than release.

If there are repeated packets ( which occurs sometimes ) they always seem to be in the correct order ( e.g. 1 or more PUSH messages, then 1 or more RELEASE messages )

Is there a 2-way pairing? Are all push messages the same or do some bits always keep changing?

I don't think it is 2-way pairing... Up to 10 RF receivers can be paired to a single button.

My plan is to use a few buttons with rtl_433, and send MQTT messages so that the buttons can be used without a specific receiver, e.g. Smart Plug.

It seems that push and release messages are consistent (with the exception of the data length which varies)

Example - 3 push and release cycles on Button 11

time      : 2022-12-05 14:01:04
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {83}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:01:04
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 82           data      : 21a4231b87c0f9dd4d690                   id        : 7047
action    : Release
codes     : {82}21a4231b87c0f9dd4d690

<GAP>

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:01:14
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 82           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {82}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:01:14
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 82           data      : 21a4231b87c0f9dd4d690                   id        : 7047
action    : Release
codes     : {82}21a4231b87c0f9dd4d690

<GAP>

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:01:20
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {83}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:01:20
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 82           data      : 21a4231b87c0f9dd4d690                   id        : 7047
action    : Release
codes     : {82}21a4231b87c0f9dd4d690

I'm totally open to suggestions... Radio is new territory for me so apologies for any confusion generated!

zuckschwerdt commented 1 year ago

If you invert the bits then your lower ID byte has the same delta of 9, see BitBench. Hard to tell from just two sensors, but that should be part of the ID, yes.

What I meant about push or release messages: are different presses always the same code? I.e. do you only ever get the same two codes for one device?

This looks too strange:

21 a4 23 1b 87 c0 7c ee a6 b4 (RELEASE Button X)
21 a4 23 b6 90 00 aa cc a6 b4 (PUSH Button Y)
                        ^^^^^ why?
21 a4 23 1b 87 01 30 b0 4d 68 (PUSH Button X)
21 a4 23 b6 90 c0 9c f4 4d 69 (RELEASE Button Y)
                        ^^^^^ why?
pazzernick commented 1 year ago

Hi Cristian,

are different presses always the same code?

For PUSH messages, yes I think so. It's not 100% clean, as the example below shows.

The first PUSH and RELEASE starts at 14:50:28 ( clean )

The second PUSH and RELEASE starts at 14:50:40 ( a few extras )

 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:28
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {83}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:28
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b87c0f9dd4d690                   id        : 7047
action    : Release
codes     : {83}21a4231b87c0f9dd4d690

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:40
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a4231b870130b04d68                    id        : 7047
action    : Push
codes     : {79}21a4231b870130b04d68
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:40
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {83}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:40
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {83}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:41
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 82           data      : 21a4231b87c0f9dd4d690                   id        : 7047
action    : Release
codes     : {82}21a4231b87c0f9dd4d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 14:50:41
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 63           data      : 21a4231b87c0f9dc                        id        : 7047
action    : Release
codes     : {63}21a4231b87c0f9dc
pazzernick commented 1 year ago

I'd be more comfortable removing the action because it's potentially inaccurate.

Anyway, it looks like the PUSH message does vary. Here is another sample showing changes.

time      : 2022-12-05 15:05:54
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a4231b870130b04d690                   id        : 7047
action    : Push
codes     : {83}21a4231b870130b04d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 15:05:55
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a4231b87c0f9dd4d68                    id        : 7047
action    : Release
codes     : {79}21a4231b87c0f9dd4d68

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 15:06:21
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a4231b870130b04d68                    id        : 7047
action    : Push
codes     : {79}21a4231b870130b04d68
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 15:06:22
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a4231b87c0f9dd4d68                    id        : 7047
action    : Release
codes     : {79}21a4231b87c0f9dd4d68
zuckschwerdt commented 1 year ago

There are some hints on the web that ENER-J might be same rebrand as Quinetic and manufactured by Baydo IOT Technology Shenzhen Co. Ltd. They state to use some EBL 1.1 communication protocol, but also no details on that.

pazzernick commented 1 year ago

Cheers, I will have a dig.

I'm tempted to use a 32bit value from offset 8 for the ID, and then get the other 10 buttons tested to verify behaviour.

As long as the ID is consistent, my requirements are met. Push vs Release is not really important.

I just need to de-bounce the multiple packages, and discard the short ones.

Does this sound like the right plan?

zuckschwerdt commented 1 year ago

Sounds good. As long as we are missing most of the protocol and can't figure out a checksum this is best left as flex decoder conf -- but PR that conf if you like.

re debounce: https://github.com/merbanan/rtl_433/blob/master/examples/rtl_433_custom.py can be a starting point.

pazzernick commented 1 year ago

I'm happy to keep as flex-decoder, based on the limited info about the protocol.

But... my reasoning for writing up a device file ( ./src/devices/quinetic.c ) was so that I could inspect the payload. Sometimes it's too short and doesn't contain the full ID, e.g. on the dirty 4th burst from button.

Perhaps I'm missing something: using bits>=75 within the flex config does not discard packages with data lengths less than 75. Because... that would solve the issue of small/partial packages.

Example of a few repeat rows with similar sizes, and also a small package.

This all came from a single PUSH and RELEASE.

time      : 2022-12-05 16:58:55
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 79           data      : 21a423b6900155994d68                    id        : a423b690
action    : Push
codes     : {79}21a423b6900155994d68
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 16:58:55
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a423b690c09cf44d690                   id        : a423b690
action    : Release
codes     : {83}21a423b690c09cf44d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 16:58:55
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 83           data      : 21a423b690c09cf44d690                   id        : a423b690
action    : Release
codes     : {83}21a423b690c09cf44d690
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2022-12-05 16:58:55
model     : Quinetic     count     : 1             num_rows  : 1             rows      : 
len       : 26           data      : 21a4238       id        : a4238055
action    : 4
codes     : {26}21a4238

Thanks for all the help guys.

pazzernick commented 1 year ago

I've tested a few flex config options to try to reduce duplicates.

I'm starting to get the feeling that if the 2nd/3rd/4th burst are picked up (based on gain setting), that the de-bouncing needs to be done outside of rtl_433, because they are separate inbound signals.

zuckschwerdt commented 1 year ago

using bits>=75 within the flex config does not discard packages with data lengths less than 75.

That filter will only exclude a message if all rows are below the limit. I.e. If any one row matches flex filters then the message is processed.

There are different ways to go about debugging or processing (e.g. dedup) a signal, I might use a flex decoder to get raw data, send that by syslog or mqtt, and use a python script for processing.

pazzernick commented 1 year ago

Yep, I follow.

Now that I've got a steady gain/pulse configuration, I've been able to properly inspect the package data.

I won't file a PR yet, because I would like to try some further improvements... e.g. checksum

Either way, this is the working configuration: Quinetic-QUGDMK.conf

I don't need any specific help at this stage, unless you can offer any improvements, suggestions, etc.

Many thanks!

pazzernick commented 1 year ago

This is the latest bitbench data

There are one or two bad-eggs within the Quinetic-QUGDMK.conf samples.

craigs21 commented 1 year ago

Hi, I've tried using your config as above but I'm using a slightly different model than you, I have 1 / 2 / 3 button switches as link (https://www.tlc-direct.co.uk/Products/QUWS2B.html) it is receiving the signals and the ID of the switch (most of the time, sometimes throws a random ID) which is fine for the single switches as you mentioned above but was wondering did you get any further with the decoding data so i could try to use it for multiple buttons on the switch?

Thanks

pazzernick commented 1 year ago

Hey...

I got testing again.... and also captured codes coming from other Quinetic hardware like smart-plugs.

I need more packet samples - so the three button switch data would be great if you can supply it!

Please dump the data into this bit-bucket, then copy the new link and provide it here. Hopefully the codes appear when you push and release on each button.

decoder {
    name=QDebug,
    modulation=FSK_PCM,
    short=10,
    long=10,
    reset=200,
    bits>=120,
    invert,
    unique,
    preamble=aaaaaaaaabde 
}
craigs21 commented 1 year ago

Hi,

Below is the 2 button switch, just working on the 3 button switch now.

Bit-bucket

pazzernick commented 1 year ago

Hi,

Below is the 2 button switch, just working on the 3 button switch now.

Bit-bucket

Can you double check it, because B1 RELEASE shows up more than expected.

craigs21 commented 1 year ago

Hi,

below is the 3 button switch, Bit-bucket

Sorry labels was wrong on the 2 button switch, see corrected bit-bucket

pazzernick commented 1 year ago

Awesome, thanks for these. They help a lot.

Do you have any more switches, because I want to confirm if the model is baked into the codes. Or, just 2 switches on hand?

I've been including the last 4 digits of the switch serial in my notes, to separate the switches out.

TIA

craigs21 commented 1 year ago

I only have the same model of switches, I have about 10 of them split across 1 / 2 / 3 button variety

The 3 button switch is on the wall but the back of the two button has the following info on the barcode sticker

ES2K2202207200477 244E000202

Then printed onto the plastic itself is

QUWS2B CW473648

The one button switch data is as below if that helps as well

a423c72e04d70650f500 PUSH a423c72e04d70650f500 PUSH a423c72e04d70650f500 PUSH a423c72ec04ece50f50 release a423c72ec04ece50ea0 release

Let me know if you need any more.

Thanks

pazzernick commented 1 year ago

Super, I could do with duplicates for the 1, 2 and 3 button variety... which almost means every switch (sorry!)

If you want to start with samples for the 1-button switches you have, let's confirm if they all have a similar code and model string. Guessing you have something like this? QU WS1B

At this juncture, I think I've got the method for extracting the individual button code, so I will probably place that into a channel-number which will enable you to determine which button is pushed down.

craigs21 commented 1 year ago

Hi,

Yes the 1 button is QU WS1B

Here is another 1 button switch data

a423152c04ba9050f50 - PUSH a423152c04ba9050f500 - PUSH a423152c04ba9050f50 - PUSH a423152cc0235850f50 - RELEASE a423152cc0235850f500 - RELEASE

2 Button which is a QU WS2B

a423a65701993950f50 - B1 PUSH a423a65701993950f50 - B1 PUSH a423a65701993950f50 - B1 PUSH a423a657c0505450f500 - B1 RELEASE a423a657c0505450f500 - B1 RELEASE a423a657c0505450f500 - B1 RELEASE a423a65702a95a50f50 - B2 PUSH a423a657c0505450f50 - B2 RELEASE a423a657c0505450f50 - B2 RELEASE a423a657c0505450f500 - B2 RELEASE

for the 3 button switch I only have one of these.

hope this helps.

craigs21 commented 1 year ago

I just noticed on MQTT that I was getting a few other ID's while gathering data for these pushes. Most of the button pushes seem to decode the ID correctly but there was a few random one's they was appearing in the data on MQTT, unsure if this is just occurring from pressing / releasing too quickly etc?

a423fd97c0e83f4c480 a423fd97c0e83f4c4800 a423fd97c0e83f4c480 a423fd9703012098800 a423fd970301104c480 a423fd970301104c4800 a4222a598046b0a1ea0 a4238e5c09ae0ca1d40 88474caf80a0a8a1ea0

pazzernick commented 1 year ago

Yep, there are a few possible reasons for the extra ID's showing up.

I've updated the config file - it should now allow you to handle the MQTT 'actioncode' of 251 - 254, for each button within the 1/2/3 switches.

My MQTT devices tree is pretty clean, and there are very few extra IDs showing up. That said, I have no paired hardware in the house right now, just 12 single switches. So very little noise...

Let me know if that config file works for your setup.

Are you planning to use the RF buttons only with rtl_433, MQTT and some Automation platform. Or, do you still have RF pairing direct with Quinetic HW?

craigs21 commented 1 year ago

Hi,

I'll give that config a test and let you know the results, I'm using Sonoff switches with Node-Red on Home Assistant fed by MQTT from the RTL_443.

I don't actually have any of the Smart Plugs or Transformers.

pazzernick commented 1 year ago

I've renamed the file and improved the decoder. Quinetic-Electrical.conf

There are still a few false-fires, e.g. the wrong ID scraped sometimes. I'm not sure how to checksum the data, so I'm just relying upon the consistent ID that is seen, combined with 'actioncode' value.

When I hold a button, my MQTT Explorer allows me to see the 'events' item from rtl_433, showing the button (actioncode) value being pushed. Hopefully that state can be used in HASS. That was my plan, based on several MQTT sensors targeting specific topics (numeric ID of switch)

blutack commented 1 year ago

If it's of any use, this video documents the checksum details and possibly has some more information on the protocol: https://www.youtube.com/watch?v=tz_F4Tjhap0

The relevant code: https://github.com/camerongray1515/Kinetic2MQTT

gdt commented 9 months ago

Where are we on this issue? It seems like one could construct PRs that would add a decoder and then we could close it, but would appreciate someone summarizing status and next steps.

craigs21 commented 8 months ago

I have multiple of these switches so can help anyone who needs test data.