Reverse engineering of a bluetooth sensor

Question

I have a problem. I'm trying to trigger some events with Arduino using some bluetooth LE sensor by a chinese manufacturer, Kaipule. I buy this sensor on Alibaba and I'm trying to understand how can I interface them in my sketch.

They are magnetic contact sensors and I know that they have just the BLE broadcasting mode (no GATT, profile etc): they send information when I open the contact or I close the contact.

I try to scan them with a BLE scanner and this is the log

kCBAdvDataIsConnectable : 0
Local Name : iSensor 
Manufacturer Data : <beca2c02 4602f9f7>

I know that:

1) the scanner can see the sensor just when I open/close the contact to save battery, so the sensor broadcast data just when it need.

2) every hour the sensor send a status signal

3) every time I open and close the contact the code change a little. Here is a sequence

<beca2c02 46025856> - > open
<beca2c02 46005955> - > close
<beca2c02 46025a58> - > open
<beca2c02 46005b57> - > close
<beca2c02 46025c5a> - > open
<beca2c02 46005d59> - > close
<beca2c02 46025e5c> - > open
<beca2c02 46005f5b> - > close

etc

4) The first part of the code is the identification of the sensor.

my sensor

3) From the changing code I assume that 2 is the status open, 0 is the status close and I see also a pattern for other bytes but I cannot understand why for example there is a rolling code.

I have the paper the company send to me, but I cannot find any useful reference.

Wireless sensor 1 Wireless sensor 2

• Andrew: The rolling code at the end could be a time indication.
• Gerben: I'm wondering what the next number would be. It could be that the second last hex-digit is the high byte of the counter. So that would mean the next number would be 4602506_. My guess for the last digit is that it is a checksum, as it's increment by 1, minus the 0/2 for open/close. Anyways, it seems like you already have all the information you need to use these sensors.
• Roberto Pezzali: @Gerben yes I know, but according to the first pdf I attached is there also a code for the battery status, and this could be useful if I want also to trig an alarm when the battery is at the end. I cannot decode their document

Answer 1

Looking at the datasheet, I interpreted it as:

Byte 1 - 0x46

Indicating this is a unidirectional device (bit7=0) that uses fixed time sending (bit 6=1 which doesn't seem correct) and it is of type 'door contact' (bits 0-5=0x06)

Byte 2 - 0x00/0x02

Indicating that the door is open or closed (bit 1 = 0 or 1). I also think that it indicates there is 'enough battery power' (bit 2 = 0), and the 'anti-tamper' has not been activated (bit 0 = 0)

Byte 3 - 0xXX

This is the 'Frame ID' - counting up for 0x40, to 0x5F then looping ?

Byte 4 - 0xXX

Checksum.

I'd do three things to test this theory:

1. Run the battery down a lot and see if the battery power indicator changes (byte 2, bit 2).
2. Open the case and see if the 'anti-tamper' bit changes (byte 2, bit 0)
3. Do sufficient switching to determine if byte 3 loops around as expected.

This these don't work out then you're likely looking at a different model.

• KennetRunner: Actually as you say that the sensor sends a signal every hour also, that makes the first byte being 0x46 correct and expected.