use ws-2300 weather station with linux and perl

ma station

Vos commentaires, remarques, suggestions:

Please send your comments or questions here:

claude.ocquidant@wanadoo.fr

Protocols (!!! PAGE IN PROGRESS !!!)...

Protocol in Reading mode:

Rs232
2400 Bauds
8 bits
N parity

RTS High
and
DTR Low
to send a command.

Read commands were first well depainct by Centauri (see link in 1st page)

Summary of reading commands:
Transmission through RS232 is made by bytes exchanges but addressing the ws 2300 memory is made by nibbles !
Thus
If you want to read a byte at address 0x1234 you will receive a byte and the following byte will be with the address 0x1236
If you need a nibble with an even address the next nibble will be got in that byte (supposing you are using Big endian)
and reading a nibble with an odd address, to get the next nibble you will have to read the next byte and separate the nibble from this receveid byte.

The general protocol is as follows:
First init the station until you are sure it is listening to you
Second send the address you will work with.
Thirst send command you want to be performed with that address
Fourth if needed, get results or send datas.
Restart to second

1°) Initialization
When starting program or when an error occurs.
set DTR low
set RTS high
PROG (send) STATION (ack)
0x06 0x02
Do it until station responds. I just read that on some new releases (ws 2305 ?) the station answers with 0x05. Please lets me know if it true, so I will try to update my scripts.

2°) Sending of the address you want to work with
Addressing is always done by sending 4 bytes, one byte at once.

Exemples:

address 0x8 send 0x0008 in four bytes

address 0x527 send 0x0527

address 0x13B0 send 0x13B0

But you also need to let the station know that you want the addressing mode. That is done by "melting" address with the 0x82 value.
The byte to send needs to obey the formula:
0x82+(address_nibble*4)

Exemple:

address 0x8 send 0x82+(0*4) then 0x82+(0*4) then 0x82+(0*4) then 0x82+(8*4)

address 0x527 send 0x82+(0*4) then 0x82+(5*4) then 0x82+(2*4) then 0x82+(7*4)

address 0x13B0 send 0x82+(1*4) then 0x82+(3*4) then 0x82+ (0xB *4) then 0x82+(0*4)

But between each byte sent, you should check the station ack to be sure the address you want is well understood, or if not you could, may be, damage your station , writing who knows where.

Station acknowledgment to each addressing byte you send:
So you need to be sure no error has occured. If an error happens resend init command, then restart sending address at the beginning.
Returned byte includes in high nibble the "raw" of the address (from 0 to 3) and in low nibble the address nibble you sent.

Exemple: Address 0x527

Ack to 1st byte ("raw" 0) sent = 0x00

Ack to 2nd byte sent = 0x15

Ack to 3rd byte sent = 0x22

Ack to 4th byte sent = 0x37

Formula is if you remember the byte sent:
Ack_byte=raw*0x10+int((byte_sent-0x82)/4).
If you remenber the nibble sent:
Ack_byte=raw*0x10+address_nibble;

Now sending the command to be performed: Here is the read command
The read command is no more 0x82 but 0xC2. This should has its own reason why but i have no mean to guess.
And you "melt" it with the number of bytes, not the number of nibbles, you want.
Formula is :
read_cmd=0xC2+(nb_byte_wanted*4)
You can ask from 0 to 0xF bytes (low nibble) so the read command cannot be more than 0xFE.
How the station acknowledges to read command
The station does not answers with 0x4N as we could think but with 0x3N, where N is the nb of byte asked.
Raw stays 3. That means you will have to NOT increase raw in the return_code formula.
Exemple 2 byte needed:
Ack=0x32

Reading wanted bytes.
Immediatly after the ack above, station sends the wanted bytes + a checksum byte. If the checksum is > 0xFF just check low byte in your compute.
Now station is ready to continue with another address followed with another command. You don't need to send init code again, but be sure DTR is low and RTS high.
If checksum is wrong you have to start again at the beginning with sending the address and so on.

Memory mapping
What I guess:
addresses 0x0 to 0x1FF are for interrupts, internal uses or vectors. Some values are usefull.
addresses 0x200 to 0x6C5 are for actual data: sensor's returned values, dates, etc
addresses 0x6C6 to 0x13B0 are for history's saved values.
Higher values as 0x2000 to 0x23FF, 0x3000 to 0c33FF etc, ROM ? or garbage ?

Reading the station saved data or history:
Addresses used to save actual datas are listed below, and all formats will be explained soon (:=((. (for now please look at the lit-XY.pl prog).
Address for saved datas or history begins at 0x6C6
You have to read 10 bytes a time, next address is 0x13 after, a checksum is returned.
Warning:
After a station reset or at 1st memory read, address 0x6C6 is not read. (data are bad or unset ?)
To read after 0xFFF first read_addressing byte to send is 0x86, station ack with 0x1 . Then continue for address coding with 0x82
Time is not saved. You have to recompute it.
Hightest address you can read is 0x13B0
Reading next datas then continues from 0x6C6 like in a continuous round linked memory.
To know more about history state you have to read address 0x06B2

Address 0x06B2, 10 bytes
byte 0 = minutes -1 you choose beetwen 2 saves
byte 1 [AB] = A=min remaining before next write for the station itself, B not tested
byte 2 ?
byte 3 ->7 time date last save [Min] [Hour] [d] [m] [y] each 1 byte long
byte 8 last raw (or record) written pointer (0 to 0xAF) 0xAF=175 = 175 records of 10 fields. address written = byte_8*0x13+0x6C6
byte 9 pointer to last written record after last station reset or after last modfication for time beetwen two saves (0 to 0xAF) then stays to 0xAF.

Understanding how to use it: (sorry for people with quick mind but my English is not very quick)

A) You want to read all history data 175 "row"
1°) If byte_9 if less than 0xAF (it should be equal to byte_8)
You start reading with address 0x6C6 to address 0x6C6*0x13*byte_8
You may read after byte_8 but you cannot compute date for these datas.
That is why if you change interval between recording all data are lost: both byte_8 and byte_9 restart to zero, so make a disk save before.

2°) if byte_9 is equal to 0xAF
You start to read the first address AFTER byte_8 that is 0x6C6*0x13*(byte_8+1) to the highest value included(0x13B0) and then continue from 0x06C6 to last written address that is 0x6C6*0x13*byte_8

B) You want to read only not disk saved data:
You must keep somewhere the date for your last disk saved history: let's call it disk_time;
let's call byte_3 -> byte 9 station_time
So nb of row to read is:
nb_row = (station_time - disk_time) / (byte_0+1)
now to compute first row to read (oldest data first)
1str_row = byte_8 - nb_row
if 1rst_row < 0
1rst_row=(byte_9 - 1rst_row)
then you compute the address as usual
addr = 0x06C6 *0x13 * 1rst_row
and you read data growing up, restarting to 0x6C6 if needed after 0x13B0

So to resume:
byte 9 start from 0 to 0xAF=175 . It remains with that value until you change byte 0 (or hard reset the station)
byte 8 do the same but restart to 0 when overwritting. and point to the last raw written at the date you read with byte 3->7
So you can recompute the dates and where (which raw) you need to read since your last save to disk.
Got it ?

Address 0x54C
Address 0x54C is read very often .
So doing , it seems we could know if we need quickly read memory or return to read actual data.
The guy who will understand the 0x54C function will help me and you a lot !!!
This guy is Kenneth in deutch newsgroup wetterfreaks
Here is his post:

HF Reception
Address: 0x54C, length 3
Command: 82 96 92 B2 CE
Answer: 33 GH IJ KL cs

Decoding:
33 - Header/3 data bytes
G - 0=cable, 3=lost connection, F=Wireless connection (HF)
H - Unknown. Always value D.
J - Unknown. Always 0
LI - Countdown timer in binary mode.
Half seconds to next data collections.
Start value is 0F for cable, 3F for missing connection and FF for wireless.
K - Unknown - value 0
cs - Checksum

My guess is that this is is used by the PC program to guess when the unit receives data. There is a small red indicator marked "HF Reception" in the PC program that indicates that the unit receives data.

More

As far as I know when station receives datas from captors, it stop sending with rs232. May be captors exchanges are IRQ driven. So may be RS232, so display and station keyboard.
That explains why when , on station display, you choose to display seconds, and using wires for captors transmission that happens more frequently, it is so long to get a quick answer from the "DISPLAY" station key. That also explains why YOU NEED TO READ MORE DATA YOU CAN in a one time.
And the algorithm of my prog: first compute all data to send in an array, all data expected in another one, then send and read without computing,just checking,but with delay if needed.
Example: reading T OUT, then TOut Min then TOut Max ,then TOut min date, then Tout Max date, could be done with 5 adresses sent to the station, 5 result reading etc. I think it is best to do that with 2 read and then reorder nibbles. It is as my prog does.
When reading history your read time must not be longer than 0x6B2 byte_1, you have to wait about 15 to 20 sec and then
restart reading.

Values are nibbles. Addressing and answers by rs232 are in byte (unsigned char)
programs configuration:

adresses and formats below are for my station whose configuration is:
date d/m/y h:m:s
Pressure hPa
Wind speed km/h
Temperature °C

adresses: name_perl_pg, hexa address, nb char to read # response description

[a,b] means 1 char or 2 Nibbles a and b
[a] means 1 byte or 1 char

#
"sec",0x200,1 # [s]econds of actual date time
#
"date",0x207,4 # [d] [m] [y] [12] ou 24 heures # here you may vary if you are little or big endian
###
"Heures",0x023B,5 # [M]in [H]ours [DayLow,DayOfWeek] [MonthLow,DayHigh] [Year,MonthHigh]
#
"heure_min",0x23B,2
#
"Vent",0x527,3 # [Speed] (0.1 m/s) [Dir,Speed_high_nibble]
... more to come ...
#
"Dvitesse",0x4EC,15 # [?] [?] [?]
#
"Vent2",0x512,3 # position alarm high wind
#
"PluieT",0x497,10
#
"Pluie24h",0x4B4,10
#
"Pluie1h",0x4D2,7
#
"TIn",0x346,7
# date Tin Min Tin Max
"DTInMinMax",0x354,10
# "TOut",0x373,7
# date TOut Min TOut Max
"DTOutMinMax",0x381,10
#
"HIn",0x3FB,3
#
"HOut",0x419,3
# Date min max
"DHInMinMax",0x401,10
# Date min max
"DHOutMinMax",0x41f,10
#
"WC",0x3A0,7
# Date min max
"DWCMinMax",0x3AE,10
#
"Dew",0x3CE,7
# Date min max "
DDewMinMax",0x3DC,10
#
"Evolution",0x26B,1
# pressions "PrCour",0x5D8,13
"PrMinMax",0x5F6,13
# Date min max "DPrMinMax",0x61E,10
"Alarm1",0x019,4
#
"Alarm2",0x020,4
# see above: HF Reception
"PtrSauve",0x54C,3
# delay between save 3 B, date late save (5 B), 2 Ptrs Mem area last saved 2 B
"HeureSauve",0x6B2,10

More to come.
More info:
a detailed rtf file is maintened by Detlef

Writing :

Writing uses the same addressing mode, followed by write command 0x42. Writing is made nibble by nibble.
A write command is issued in reverse order of reading, so to write 0x123 you have to send 3, 2 , 1.
End of write should be send with 0x82 (ack 0x0) ?
Nibbles you write are, in the same way as addresses, linked with write command 0x42 so to write nibble 6 send 0x42+(0x6*4) = 0x52.
Station answers with
high nibble always 1
low nibble the nibble you are writing. (Ack for 0x52 is 0x16).
Writing is used to reset minima and maxima and their dates.

Setting Alarms :

Be carefull: alarms values writing uses this write mode to write in an address the alarm value you want the station tests, but a special mode is needed to inform the station you want to check this alarm. So you need to set or unset bits at addresses 0x0019 and 0x0020 and next.
starting at address 0x0019 are states of alarms we want to survey
starting at address 0x0020 are states of targeted alarms
How are alarms bit mapped ?
Each byte has 2 nibbles
Each Nibles has 4 bits
2 low bits in a nibble are for one alarm
2 high bits in a nibble are for another alarm
In a couple of bit low bit is for low alarm status (set or unset)
high bit is for high alarm status.
Exceptions are for wind dir alarms
So to say to the station you want to survey an alarm or you don't want any more survey you have to set or unset the right bit into the right nibble into the right byte (;=))
(Have a glance in file lit-res-XY.pl to know more about addresses of all these bytes nibbles and bits)
So you have to know how to set or unset a bit
What I guessed:
setbit command
command is 12+(4*bit) bit from 0 to 3.
ack = 4+bit
unsetbit is 12+(4*bit)+0x20
ack=0xC + bit

But that is not enough !
and here it is I'am stopped
After setting right bit, there is a special call to a register or a fonction: 0x25B
Then a setbit command, not always the same at address 0x0008 (Is it a port, a vector, an interrupt ?).
If you understand more or have any idea of what kind of processor or system if behind the station, please send me a post. (:=))

A suivre ... More to come... It would be nice if you could help me to rewrite this page in good english.

Retour