Saturday, March 17, 2012

Davis Weather Wizard - Hacking the Serial Port - V


Missed by Twenty-five thousandths? Well at least I gave the last 0.025% to other than I2C. Let's just say the Weather link is very...well.."I2C-like"

Device(Read)(Write)BP I2C read TIME @ 0xBE command:   TXT: 
10x03(0x01 R)0x02?(0x01)?[0x020xBE[0x03r:3[0x02 0xBE [0x03 r:3 
20x05(0x02 R)0x04(0x02 W)[0x040xBE[0x05r:3[0x04 0xBE [0x05 r:3 
30x07(0x03 R)0x06(0x03 W)[0x060xBE[0x07r:3[0x06 0xBE [0x07 r:3 
40x09(0x04 R)0x08(0x04 W)[0x080xBE[0x09r:3[0x08 0xBE [0x09 r:3 
50x0B(0x05 R)0x0A(0x05 W)[0x0A0xBE[0x0Br:3[0x0A 0xBE [0x0B r:3 
60x0D(0x06 R)0x0C(0x06 W)[0x0C0xBE[0x0Dr:3[0x0C 0xBE [0x0D r:3 
...
70x0F(0x07 R)0x0E(0x07 W)[0x0E0xBE[0x0Fr:3[0x0E 0xBE [0x0F r:3 
80x11(0x08 R)0x10(0x08 W)[0x100xBE[0x11r:3[0x10 0xBE [0x11 r:3 
1260xFD(0x7E R)0xFC(0x7E W)[0xFC0xBE[0xFDr:3[0xFC 0xBE [0xFD r:3 
1270xFF(0x7F R)0xFE(0x7F W)[0xFE0xBE[0xFFr:3[0xFE 0xBE [0xFF r:3 

There were a few things that bothered me about that address search. First, the fact there are 127 device addresses. This did not seem like a normal I2C device. Second, the first device does not even have a Write location. Other than those issues the outputs seemed normal so the plan was to drop the text generated commands (one by one) into the BP's serial port and examine the outputs for the one that had the same BCD values as the Wizard's display. ...Simple?

[0x02 0xBE [0x03 r:3
[0x04 0xBE [0x05 r:3
[0x06 0xBE [0x07 r:3
[0x08 0xBE [0x09 r:3
[0x0A 0xBE [0x0B r:3
[0x0C 0xBE [0x0D r:3
[0x0E 0xBE [0x0F r:3
...
[0xF4 0xBE [0xF5 r:3
[0xF6 0xBE [0xF7 r:3
[0xF8 0xBE [0xF9 r:3
[0xFA 0xBE [0xFB r:3
[0xFC 0xBE [0xFD r:3
[0xFE 0xBE [0xFF r:3

Well, there was one catch to this plan. I alluded to it on the last post. The bus gets hung up after every start command issued!

I2C>[0x03 0x04 [0x03 0xBE r:3]
I2C START BIT
WRITE: 0x03 ACK
WRITE: 0x04 ACK
Warning: *Short or no pull-up
I2C START BIT
WRITE: 0x03 ACK
WRITE: 0xBE ACK
READ: 0x00 ACK 0x00 ACK 0x00
NACK
I2C STOP BIT

So this was a typical output when I ran those commands trough. I could not yet find a reliable way to clear the error by toggling the power and pull ups either. The only way to clear the error for sure is to power cycle the Wizard.

Although while using the commands I did find a particularly interesting combination of toggling the lines would, in fact cause the console to beep!

I2C STOP BIT
I2C>[
Warning: *Short or no pull-up
I2C START BIT
I2C>P
Pull-up resistors ON
Warning: no voltage on Vpullup pin
I2C>W
Power supplies ON
I2C>pP
Pull-up resistors OFF
Pull-up resistors ON
Warning: no voltage on Vpullup pin


So, where does this leave us? Well besides the obvious, we did not gain control of the unit through I2C, I think I will cut my losses and let this project go! Yeah, I am admitting defeat! I think that since this is most likely a proprietary implementation of a 2-wire interface, that unless I set up a snoop with a logic analyzer between an actual Weather Link Data Logger and the Wizard to find the actual outputs and inputs with a known command sequence. I think that would be the only way, and that investment is not what I want to do at this time, hey my time is valuable and once more than a few idle hours get invested, it becomes, well, WORK! I get paid to engineer stuff for companies, and I think that when it gets to that point... I will just buy the damned software, throw out the disk, hook up the LOGGER and be done with it.

I will shelve this hack for now, unless I come up with another inspiring idea...it would be really cool to figure this out...But, if one of you, my dear readers, wants to part with their LOGGER! *hint*

~ ~ ~
SK

Sunday, March 11, 2012

Davis Weather Wizard - Hacking the Serial Port - IV



Success!!? I spent a few hours this weekend figuring out the syntax and commands on the Bus Pirate board.  So, after building a cable, and fussing around a little with the pull up settings, and unless the BP macro is giving me phantom devices...



I2C Address Scan of Wizard w/ BP!

We are in.  ☺ Yeah, it found devices, 127 of them!  The problem now is which device(s) contain the defined Bank 0 and Bank 1 data.  The other worry I have is I never heard the third beep, recognising a valid Data Logger device.\ So simply having a I2C master is not enough.  My fear is that unless one of these devices gets a handshake of some kind the data will not be processed for the data logger device. 





The next step?  I think I may need to write a macro to read out some of this info from a number of these devices at a time.  The nibbles I think I will go after first is the date/time. The 6 nibbles starting at 0x1BE (BANK 1 - 190th location)  This data should be recognisable, the same time as the console, with one BCD digit at 0x1C2 incrementing every second.  Or simply brute force a dump out some consecutive locations at each of these devices to see if anything starts to line up with that published memory map.


Here are the connection details for my cable used to connect BP to WeatherLink connector on the Wiz .  Note; that I intentionally did not wire the +12V (BLACK) wire.  I did not want to accidentally expose the BP to that +12V supply on its maiden hack!  I simply soldered a 3-pin male header to the phone cable and plugged in the BP cable to the other side


What a neat little tool that is BTW...Oh, I have some projects in mind for the Radio Ranch with that thing. 

☺☺☺

Sunday, March 4, 2012

Davis Weather Wizard - Hacking the Serial Port - III




I am always telling folks at work to read and understand the specs. Before you start anything... well, ahem, I need to listen to my own advice from time-to-time.  I sat down this weekend and really looked through the Davis documentation Not a usual thing to do on an abnormally sunny day, (It was a record 85F high, 19F above normal BTW)  but I did it over a couple cups of morning coffee.

From which I learned that the Wizard is definitely *not* compatible with the Vantage...

http://www.davisnet.com/support/weather/downloads/



The first of the downloaded documents of interest for the Wiz was:

WeatherLink Serial Communications Reference V3.3  1/22/1999

An amazing bucket of information they released, in fact contains almost everything a programmer could ask for, short of the source code.  I am actually a little embarrassed by some of my earlier speculative posts, all the info I should need is contained in this single document  ...with ONE glaring exception (more on this later)

But for now anyway, it looks you will still need the Davis Link Interface / Data Logger (dongle) to communicate with the Wizard!

0D 0D 0D OD 00 0D 0D 0D OD 00 0D 0D 0D OD 00 0D 0D 0D OD 00...

THIS IS THE CLOSEST THING I GOT TO RESPONSE WITH TTL LEVEL SERIAL DATA...FOR EVERY 4 CHARACTERS INPUT, THE RX LINE DROPS TO LOW LEVEL, SOUNDS A LOT LIKE AN ACK/NAK RESPONSE.... IT DOES NOT SEEM TO MATTER WHAT THE CHAR IS OR EVEN THE DATA RATE, IT IS JUST APPEARS TO BE LOOKING AT THE TRANSITIONS...

After poking around with the device a bit more this weekend, I have finally come to the conclusion that the protocol between the little weather link module and the Wizard III, with about 99.975% certainty, it is the two wire interface: I2C. 

A simple RS232 -> 5V TTL converter won't communicate with the wizard.  All is not lost!  We in all probability wake this thing up eventually, but we will need a serial to I2C converter...sound familiar?




The order went to those sparky guys in Boulder, CO for one today...  I am thinking that this $30 device can also be the interface substitute for the Davis Dongle as well?

BACK TO THE PROTOCOL:  There are only a few responses that Weather link provides:

"...If a command is understood, an ASCII 6 (0x06) (ACK) is returned (before any returned data).  If the command was not understood, an ASCII 33 (0x21) (!) is returned...."


So in order to verify the link is talking, we should get a "!"  (0x21) in response to a corrupted or otherwise unrecognized command:

xxxx0D 21







View from the $40 Digital 'Scope View - I gotta get one!  Had a little trouble triggering it, but it did the job.  You can also save waveforms but I did not attempt to this weekend All-in-all a nifty portable scope!
This view is the 0x0D input to the pins which produced dismal results.  I now suspect that one pin is SDA and the other is the SCL line of a two wire interface, most likely I2C,  I have a strong suspicion as well the serial data won't come out of the wizard until the Master/Slave relationship or some other digital courtships occurs!  Then and only then the happy little 3rd beep will emit and all the good info can be put to use...

! ! !

The major interface to the Wizard is only a few commands:

"...The commands "RRD" and "RWR" operate on the link processor memory. These commands execute faster than the "WRD" and "WWR" commands which operate on the station processor memory..."


They operate on two banks in nibbles and must be followed by a CR (0x0D):

"...Commands must be in upper case and terminated with a carriage return (0dh). Do not insert spaces between binary data arguments. If an argument description uses the character '|' then one byte of data is to be formed from the 4 bit values on either side. For example: "bank | n-1" becomes the single byte "0x13" where bank = 1 and n = 4"

Finally, the major command we need to get real time data for APRS modem is the vaunted "LOOP" command:
MULTI LOOPS (65536 –n) so for 1 loop:   
4C 4F 4F 50 FF FF 0D...
     start of block                     1 byte
     inside temperature                 2 bytes
     outside temperature                2 bytes
     wind speed                         1 byte
     wind direction                     2 bytes
     barometer                          2 bytes
     inside humidity                    1 byte
     outside humidity                   1 byte
     total rain                         2 bytes
     not used                           2 bytes
     CRC checksum                       2 bytes
                                       --------
                                       18 bytes
MULTI LOOPS (65536 –n) so for 5 loops:                      
4C 4F 4F 50 FB FF 0D….
I am not sure what use this can be...maybe if you hjave l0ts of link err0rs...or doing some averaging??




There is a lot of good info about the check sum and the data formats:

"...Some commands return a data stream and a CRC check sum.  The generator polynomial for the check sum is x^16 + x^12 + x^5 + 1 (CRC-CCITT backward)...


"...All binary data is transferred in "Intel" format: least significant byte first. In addition, multi-nibble data values on the station are stored least significant nibble first. This does not make a difference when you look at byte sized pieces of memory, since the Link will correctly align the nibbles when sending byte data. "

In a nutshell; this tells us pretty much how these bytes and bits go in and out.  Here are some examples of the actual hex bytes needed to implement some of these commands, and even some expected responses:


INSIDE TEMP (@ LOCATION 0x30 = 0x2D8 => 728  => 72.8F):
57 52 44 44 30 0D 06 D8 02


BAD COMMAND (NAK = 0x21 "!") :
...0D 21

I would think a 0x0d without any proceeding data would not get recognised and produce a " ! " as well.

! ! !

...AND with the upcoming DST time change it got me thinking that these commands hopefully will work as well:

GET TIME (06:37:02)
57 52 44 64 BE 0D 06 06 37 02  

SET TIME (04:25:00)
57 57 52 63 BE 04 25 00 0D 06  



GET DATE (9/20)
57 52 44 44 C8 0D 06 20 09


SET DATE (to today's date 03/04)
57 57 52 43 C8 04 03 0D 06


SET DATE (12/31)
57 57 52 43 C8 31 0C 0D 06
                   

Note: From the appendix , the time and day are in BCD,  but the month is only 4-bits, so the last day of the year 12/31 is shown as above.

0064     SpdHTime:   DS  4      ; BCD hour and minutes of hi.
0068     SpdHDate:   DS  3      ; BCD day of month + 1 nibble for month
So if you have the data logger dongle and want to be free of using a PC to generate your APRS info into your packet modem from the Wizard itself...you are in luck! Stay tuned here and I will soon modify my existing APRS modem code to accomplish this via the serial link which should show you the gorey details of formatting the data into a proper DVS weather packet. 

If you don't have a Weather Link / Data Logger module all is not lost!  I will follow this shortly with the results using a 2-Wire interface (soon as I sort out the details, hopefully, with the help of the Buss Pirate)

As for that glaring omission?  While these documents and code snippets are a wealth of info for the RS232 side of the interface, there are no specs on the dongle to Wizard side.

The assumption is, of course, that the command structure is the same for both interfaces and simply passes these along as the Vantage does. 

I have reached some of the technical details with the aid of that handy little gadget, the pocket O'scope, which I only borrowed to do some more snooping on those two pins this weekend:

"...Once SCL is high, and the master waits a minimum time (4 μs for standard speed I²C) to ensure the receiver has seen the bit, then pulls it low again. This completes transmission of one bit.
After every 8 data bits in one direction, an "acknowledge" bit is transmitted in the other. The transmitter and receiver switch roles for one bit and the erstwhile receiver transmits a single 0 bit (ACK) back. If the transmitter sees a 1 bit (NACK) instead, it learns that:
  • (If master transmitting to slave) The slave is unable to accept the data. No such slave, command not understood, or unable to accept any more data.
  • (If slave transmitting to master) The master wishes the transfer to stop after this data byte.
After the acknowledge bit, the master may do one of three things:
  1. Prepare to transfer another byte of data: the transmitter set SDA, and the master pulses SCL high..
  2. Send a "Stop": Set SDA low, let SCL go high, then let SDA go high. This releases the I²C bus.
  3. Send a "Repeated start": Set SDA high, let SCL go high, and pull SDA low again. This starts a new I²C bus transaction without releasing the bus.
- Wikipedia


Wow! this looks a lot like what I was seeing stimulating these inputs... even more interesing; They actually used the word "erstwhile" in this definition?  ...Really?  

erst·while/ˈərstˌ(h)wīl/

Adjective:
Former.
Adverb:
Formerly.
Synonyms:
adjective.  former - quondam - sometime - late
adverb.  formerly - erst - once - before - heretofore - previously

~ ~ ~