Reading Wireless Air Transmitter using Arduino

[rg422]

I'm interested in what you all are working on. I wanted to add that shearwater's swift transmitter was processed through the FCC recently and has more info available. The swift is backwards compatible so presumably info found here applies to the older MH8A transmitters.

FCC ID 2AO24-17001 Air integration pressure transmitter by Shearwater Research Inc.

FCC ID application submitted by Shearwater Research Inc. for Air integration pressure transmitter for FCC ID 2AO24-17001. Approved Frequencies, User Manuals, Photos, and Wireless Reports.

fccid.io

If anyone has a flooded/dead transmitter that they weren't able to warranty I'd be happy to take it off your hands to further this research.

 

[telemonster]

Interesting pics from the FCC system on the new boards.

I can see two TI chips, then probably a MCU. I can't quite make out part numbers, but assume it's all software synthesized.

Good job on capturing the output. My ham radio didn't succeed, but maybe I will try a wire loop like you all have mentioned with a DSO scope. I think I should have at least one audio interface that goes up to 96khz but can't think if I have any that do 192khz.

Since the Perdix AI can filter by serial number, it transmits it's serial # along with pressure. Maybe get similar pressure but different serials, and same serials different pressures to compare difference?

 

[rg422]

Good job on capturing the output. My ham radio didn't succeed, but maybe I will try a wire loop like you all have mentioned with a DSO scope. I think I should have at least one audio interface that goes up to 96khz but can't think if I have any that do 192khz.

I have a SDRplay RSP1a, it's a SDR advertised as being able to receive all the way down to 1kHz. Connecting that to a magnetic field probe or even a speaker's winding should be able to hear the signal. I'm keeping my eye out for a used transmitter so I can get to decoding the signal.

 

[rg422]

Here is a screenshot of my SDR clearly receiving the signal, I used a speaker winding as an antenna (as pictured). Did we decide it was CW/FSK modulation? I will get some recordings and post them here for you all to pick at.

 

[-JD-]

Here is a screenshot of my SDR clearly receiving the signal, I used a speaker winding as an antenna (as pictured). Did we decide it was CW/FSK modulation? I will get some recordings and post them here for you all to pick at.

Transmitter ID and Pressure recieved by the Teric at the time of the recording will be helpful in decoding/verification.

 

[Ryebrye]

Has anyone taken a look at the Shearwater firmware to see what they are doing? Or is it just handled in a receiver chip and handed off as a digital signal over i2c or something?

Might be interesting to throw Ghidra at it

 

[rg422]

So here is what I have so far. Signal is ASK/OOK at 38kHz. Using the speaker coil attached to RSP1a as pictured previously I was able to get a very clear and strong reception. Using the prior discussed method of short pause 0 and long pause = 1 decoding I decoded the ~60 bit string at a known pressure. Below is a breakdown of what I have learned so far. I am still unsure how the transmitter ID is encoded in there.

At first I tried to use Universal Radio Hacker software to decode it for me but I couldn't figure out how to get it to decode it using the simple method we established. If anyone wants that file with the raw samples from the radio let me know I will send it over.

If anyone can identify how that ID (mine is 104308) is encoded in there please let me know.
P.S. I'm using one of those old oceanic transmitters (all I could afford on a high schoolers budget) therefore this is probably the simplest and original message, future versions like the Shearwater SWIFT likely include more data following the normal message.

 

[tursiops]

I think you've got it! Good work!

So the format is:
001 = Preamble
00000 = break
18 bits Binary = Transmitter ID, but how is it coded?
00000 = break
8 bits Binary = psi/2 [this make sense; the spec'ed pressure resolution is 2 psi]
00000 = break
7 bits Binary = battery*

*Your battery numbers were 87, 95. 91, 70. It is doubtful those are percentages; they would not drop that much, since the batteries last a year or more. The CR2 battery has a nominal voltage of 3 volts, so perhaps those last digits are XX of 2.XX or something like that. The MH8A indeed transmits its battery status, although not all AI dive computers read/display it. The Shearwater's display Warning at 2.75 volts, and Critical at 2.5V.

Things to do:
1) measure the battery voltage outside the transmitter
2) try a different transmitter and get two shots at decoding the ID


I suspect the SWIFT sends the identical message, because it is read by any dive computer that can read the MH8A. All the SWIFT does is vary the transmission interval if it hears other transmissions.

[corrections made in this post, mea culpa. sorry.]

 

[rg422]

I'm quite inexperienced with this sort of thing, how did you convert the green to my ID? I've put it into plenty of online binary to decimal converters and gotten the wrong numbers.

The battery for the 364 psi was when it had already been running for a while, the others were recoded in quick succession. Lithium batteries tend to sag down to their voltage under load. Perhaps that's it. I have no idea how old the battery is.

I have a variable power supply, If I'm feeling brave I might connect it to the transmitter along with a volt meter for precise readings then see how that last section of the message changes.

 

[rg422]

Has anyone taken a look at the Shearwater firmware to see what they are doing? Or is it just handled in a receiver chip and handed off as a digital signal over i2c or something?

Might be interesting to throw Ghidra at it

The processor on the SWIFT tx or computers is very likely read protected or wont allow a dump of the firmware.