The CM130 is an Oregon-Scientific v3 family energy monitor, sister to the
CM160/CM180. Decode the 96-bit message (preamble 00 00 00 60): house
code, instantaneous power (16-bit LE count, 16 W per count) and a
cumulative energy counter reported as energy_kWh = counter / 8192
(8192 = 2^13 = 16 * 512, matching the power scale of 16). This is the
meter's absolute lifetime total, so it reads higher than the console,
which shows a relative value with a device-specific offset.
The checksum, unsolved in the issue for years, is a CRC-8 (poly 0x07,
init 0) over message bytes 1..10 compared against the nibble-swapped
byte 11; validated against all 50 known messages.
Generic-brand two-probe BBQ/meat thermometer, FCC ID 2APN2-EN2053,
sold e.g. as Feelle Digital Thermometer. Reverse engineered from the
captures, audio recording and annotated codes posted in the issue.
The checksum byte, unsolved in the issue thread, packs four even-parity
flags and a modulo-8 sum of the four message bytes; it matches all 37
known-good messages across both probe channels.
The BIOWIN / 2measure / Bioterm No. 270208 weather station from issue
#1476 turns out to transmit the exact Holman WS5029 older-PWM frame,
same preamble, layout and xor_shift_bytes checksum, but OOK modulated
instead of FSK. Register the existing decoder for OOK as well.
The wind direction field, unresolved in the issue, was recovered by
testing bit windows against the reporter's compass annotations and
matches the Holman layout. No barometric pressure is transmitted, the
display console likely measures it locally.
Some units run long pulses close to 1100 us, just past the old
long_width(1020)+tolerance(80) cutoff, causing the pulse slicer to
intermittently mis-frame messages. Widen tolerance to 100 us (closes#1458).
Reverse-engineered from real captures and analysis in the issue
discussion. OOK PPM, 30 bits repeated ~9 times: a 16-bit id (observed
fixed on the one unit tested), a 13-bit temperature, and a parity bit
(XOR of all 30 bits is always 1).
Source: https://github.com/merbanan/rtl_433/issues/1223
Reverse-engineered from Clayton Smith's gr-elster project and real
captures posted in the issue thread. FSK Manchester-encoded, whitened
with 0x55, CRC-16/X-25 protected. Disabled by default pending wider
field-testing; the protocol is only partially reverse-engineered
(the hourly-usage sub-command decode is a port of the reference
implementation, not independently confirmed against a real capture).
Source: https://github.com/merbanan/rtl_433/issues/1196
Some TSN-70E units transmit a 24-bit ID (message length 7) instead of
the usual 16-bit one (message length 5). Also fixes a row-length
sanity check that referenced the wrong bitbuffer row index.
Source: https://github.com/merbanan/rtl_433/pull/3488
Co-authored-by: Boing <dhs.mobil@gmail.com>
- secplus_v1: stateful + time-based (caches first packet half, 800ms timeout)
- secplus_v2: stateful + time-based (caches first packet half, 800ms timeout)
- ikea_sparsnas: stateful (caches brute-forced sensor ID)
Replaces existing @warning tags with the @attention format
proposed in PR #3501 to standardize tracking of decoders
that are not pure functions.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
LastConsumptionCount (IDM and NETIDM), LastGenerationCount (NETIDM), and
Consumption (SCMplus) are all parsed as uint32_t but were emitted via
DATA_INT, which formats them as signed int. Once a meter's lifetime
counter rolls past 2^31 (≈ 2.15 billion ticks), the displayed value
flips negative — observed in the wild on multiple Itron meters with
LastConsumptionCount values like -2,059,230,912 (actually 2,235,736,384
unsigned).
Use the existing `DATA_FORMAT, "%u", DATA_INT, value` idiom (already in
use by emontx.c, holman_ws5029.c, emax.c, and others) to render these
correctly as unsigned. No type change needed since the bit pattern
matches; only the printf format string changes.
The 9-bit and 14-bit DifferentialConsumptionIntervals values are well
within int range and don't need the change.
Co-authored-by: cyberpods <whittlewoodwoodworks@gmail.com>
Fixes the Trigger bit mapping (was inverted) in the OOK_DMC flex
decoder worked out in issue #1194's discussion (originally by
@klohner, confirmed against real hardware by @kvdveer). Validated
against both sample capture sets attached to that issue: 12 of 16
files decode cleanly, each of 3 distinct physical sensors correctly
alternating between exactly two State values with a fixed ID.
No checksum exists in this protocol, so this remains a flex config
rather than a full C decoder for now.
Closes#1194.
Decoder for the Martec MPLCD combined light dimmer/fan speed remote:
OOK PWM, 22-bit frame with a reflected/inverted channel ID, 7-bit
dimmer level, 2-bit fan speed, and a 4-bit nibble-sum checksum. The
remote holds its own state and resends the full light+fan setting on
every button press.
Ported from merbanan/rtl_433#3133 (originally by clockbrain/Don
Ashdown). Verified against the 3 sample captures from
merbanan/rtl_433_tests#474 — all decode with valid checksums and match
the documented expected values exactly (channel/speed, and a
progressive dimmer sweep for the long-press sample).
The LTV-TH2i shares the LTV-TH2/TH3 framing but uses a third CRC-8
init value (0xb2) that appears to be selected arbitrarily by the
sensor, alongside the existing 0x00/0xac variants. Also exposes the
previously-unlabeled flag bits as battery_ok and retransmit, and only
emits the remaining unknown flags when non-zero.
Ported from merbanan/rtl_433#3406 (originally by Cory Snider), applied
against master's current data_make layout (DATA_COND model selection)
since the PR's diff predates that refactor.
Verified against the samples from merbanan/rtl_433_tests#404: g002
already decoded as plain LTV-TH2 before this change; g001 failed to
decode on master and now decodes correctly with the new 0xb2 CRC
check, confirming it uses the TH2i variant (same sensor id as g002,
consecutive sequence number). TH3 samples decode unaffected.
Decoder for RFXMeter/RFXPower devices, using X10RF-like PPM framing
with an address-complement check and a nibble-sum checksum.
Cleaned up and rebased from merbanan/rtl_433#2142 (originally by
Christian W. Zuckschwerdt), closes#2141. Verified against the sample
captures from that issue.
Co-authored-by: Christian W. Zuckschwerdt <christian@zuckschwerdt.org>
Decoder for the TR-502MSV remote for RC-710DX smart sockets, based on
merbanan/rtl_433#2921 by Filip Kosecek.
Applies the simplifications requested in review (direct mask/shift
field extraction instead of bit reformatting helpers, table lookups
for socket/command strings) and resolves the previously unknown 2-bit
checksum: U1 = C ^ S2 ^ S0, U0 = O ^ S1, derived from the sample table
posted in the PR discussion and verified against all 13 captured
samples in filipkosecek/rtl_433_tests#467.
Co-authored-by: Filip Kosecek <filip.kosecek@gmail.com>
Remote Grill Thermometer with probe (FCC ID TXRFPT0912), sold under
the RF-T0912 model number. Decodes a 16-bit Fahrenheit temperature
with an 8-bit checksum, repeated across multiple rows for reliable
detection, and reports an overload condition.
Co-authored-by: Ethan Halsall <ethanhalsall11@augustana.edu>
* Add support for Aldi Sempre 4-AH0423-4 temperature/rain sensor
* Improve documentation for Aldi Sempre 4-AH0423-4 temperature/rain sensor
---------
Co-authored-by: Gerald Reisinger <gerald.reisinger@husqvarnagroup.com>
Adapted from Christian Zuckschwerdt's untested sketch in PR #3113 and
fixed/verified against real hardware captures in issue #3112 (thanks to
yashikada for testing and reporting the corrected bit layout). Supports
both of the HCS362's transmission modes: PWM (mode 0) and Manchester
(mode 1), sharing a single decode callback that branches on the demod
modulation.
Co-authored-by: Christian W. Zuckschwerdt <zany@triq.net>
Based on PR #1877: MSVC /analyze flags int arithmetic that gets
implicitly widened before a double/float use.
- magnitude_true_cu8/cs16: use sqrtf() instead of promoting the
int sum-of-squares to double, per review feedback on #1877 that
double math is undesirable in this hot path.
- baseband_demod_FM(_cs16): cast low_pass to double in the debug
log line only, harmless since it's not per-sample code.
- pulse_analyzer: regroup the FSK offset calculation with explicit
parens (no behavior change, same left-to-right eval order).
Drops the PR's S_CONST/S_CONST32 cast (no-op, doesn't fix anything)
and the seven `.max + 1` -> `.max + 1.0` edits in pulse_analyzer.c,
which reviewers flagged as false positives that shouldn't be fixed
by turning int addition into double addition.
Based on PR #1875: several size_t values (from strlen(), fread(),
list_t.len, struct addrinfo::ai_addrlen) were implicitly narrowed to
int/unsigned/socklen_t, which triggers MSVC C4267 warnings on x64
Windows builds. Adds explicit casts and widens a few parameter/local
types to size_t where that is the semantically correct type.
Excludes the original PR's mongoose-related mg_send() casts, and
drops two hunks (flex.c, honeywell_cm921.c) that no longer apply
since the affected code was refactored away since 2021.
Co-authored-by: obones <1314739+obones@users.noreply.github.com>
TPMS decoder for the Schrader MRXBC5A4 sensor (also sold as
MRXBMW433TX1), used on BMW vehicles. Decodes id, pressure, and
temperature, and verifies the packet's 2-bit C1C2 integrity check.
Based on merbanan/rtl_433#1702 by drid, with the C1C2 integrity
check formula derived by merbanan from RDC test tool data.
Regenerate README.md and conf/rtl_433.example.conf device list text that
had gone stale after previous decoder changes (ESA/Gira, Nissan TPMS,
Honda Keyfob naming).
Adds an alternate decoding of the Honda/Continental KR5V2X remote as a
separate decoder alongside continental_car_remote, adapted from
gusgorman402's unmerged PR #2767 (honda_kr5vxx.c) with cleanup to match
project style. The two decoders disagree on bit layout and checksum for
the same physical hardware.
The new translation if based on my experience with alkaline cells, and
having a failure within hours of battery_ok and battery_mv dropping to
0.55 and 1200. A battery at 55% should be fine, of course. While
there may be energy in the battery, once the device reports 1200 there
was a very short time until operation became erratic and the device
went offline. The scale is about the remaining life of the battery in
terms of correct operation of the specific device.
Implements the sum2N checksum from issue #1024 to validate frames,
fixes the pressure_PSI calculation, and enables the decoder by
default now that it can reject invalid packets.
Some newer R900 meters (Non-BCD, e.g. V4) split the former 8-bit
Unknown1 byte into a 4-bit Unknown1 and a 4-bit Meter Type, and
appear to add 2 more bits to the Consumption field from Unknown3.
