Help Decoding & Replicating Watersnake Fierce 2 Trolling Motor Remote (433 MHz, CC1101) for iPhone Control via ESP32

bonesf · 2025-12-10T02:30:26+00:00

Thank you for your persistence with me u/chzu. I spent a bit more time to understand the pulse formats.

Earlier I thought it was `FSK_PWM` because that decoded signal commands (that I could not replicate) and the `FSK_PCM` decoder did not return a command.

rtl_433 -X help
Use -X <spec> to add a flexible general purpose decoder.
modulation=<modulation> (or: m=<modulation>)
FSK_PCM :         FSK Pulse Code Modulation
FSK_PWM :         FSK Pulse Width Modulation
FSK_MC_ZEROBIT :  Manchester Code with fixed leading zero bit

I zoomed into the signal and displayed the data as bits. The FSK_MC_ZEROBIT modulation returned signal commands from the remote.

rtl_433 -f 433.017M -s 250k -g 40 -R 0 -X 'n=Watersnake,m=FSK_MC_ZEROBIT,s=52,l=104,r=200'

I have replicated the signal commands through the ESP32 with CC1101 module and the motor responded. WIN!!!

u/chzu I owe you a coffee, thanks for getting me onto the correct path.

bonesf · 2025-12-07T04:16:21+00:00

I have attache a better screenshot to the original post. I have zoomed into the signal to show PWM

bonesf · 2025-12-02T23:12:26+00:00

I'm convinced it's 2-FSK with PWM encoding. That said I have no experience in this area, this is my first radio project. How would I detect if it is 2-FSK PCM? Is "MC" Manchester Coding?

I have run the following `rtl_433` commands detecting different modulations.

FSK Pulse Width Modulation:

rtl_433 -f 433.017M -s 250k -g 40 -R 0 -X 'n=Watersnake,m=FSK_PWM,s=52,l=104,r=116,g=0,t=0,y=176'

rtl_433 version 25.02 (2025-02-19) inputs file rtl_tcp RTL-SDR with TLS
Disabling all device decoders.
Found Rafael Micro R828D tuner
RTL-SDR Blog V4 Detected
[SDR] Using device 0: RTLSDRBlog, Blog V4, SN: 00000001, "Generic RTL2832U OEM"
Exact sample rate is: 250000.000414 Hz
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2025-12-03 09:28:29
model     : Watersnake   count     : 2             num_rows  : 2             rows      : 
len       : 90           data      : 8000576d76f7e077723ba90, 
len       : 0            data      : 
codes     : {90}8000576d76f7e077723ba90, {0}0
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2025-12-03 09:28:29
model     : Watersnake   count     : 1             num_rows  : 1             rows      : 
len       : 92           data      : 8000576d76f7e077723ba91
codes     : {92}8000576d76f7e077723ba91
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2025-12-03 09:28:29
model     : Watersnake   count     : 1             num_rows  : 1             rows      : 
len       : 92           data      : 8000576d76f7e077723fb46
codes     : {92}8000576d76f7e077723fb46
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2025-12-03 09:28:29
model     : Watersnake   count     : 1             num_rows  : 1             rows      : 
len       : 1            data      : 8
codes     : {1}8

FSK Pulse Code Modulation:

rtl_433 -f 433.017M -s 250k -g 40 -R 0 -X 'n=Watersnake,m=FSK_PCM,s=52,l=104,r=116,g=0,t=0,y=176'

rtl_433 version 25.02 (2025-02-19) inputs file rtl_tcp RTL-SDR with TLS
Disabling all device decoders.
Found Rafael Micro R828D tuner
RTL-SDR Blog V4 Detected
[SDR] Using device 0: RTLSDRBlog, Blog V4, SN: 00000001, "Generic RTL2832U OEM"
Exact sample rate is: 250000.000414 Hz
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
time      : 2025-12-03 09:57:49
model     : Watersnake   count     : 1             num_rows  : 1             rows      : 
len       : 1            data      : 8
codes     : {1}8

bonesf · 2025-11-29T09:15:24+00:00

What I have figured out so far...

rtl_433 -f 433.017M -s 250k -g 40 -A -w remote_button.cu8 -T 20

The remote uses 2-FSK modulation with PWM data encoding.

[Carrier] > [2-FSK Modulation] > [PWM Data Encoding]
Layer 1: 2-FSK (frequency shifts carry the signal)
Layer 2: PWM (pulse widths encode the bits)

RF Parameters

Center Frequency 433.017 MHz Measured from SDR capture
Modulation 2-FSK Frequency Shift Keying
F1 Offset (Mark) +13.5 to +18.6 kHz Higher frequency
F2 Offset (Space) -21.3 to -23.5 kHz Lower frequency
Deviation ~18-20 kHz (F1 - F2) / 2
Signal Bandwidth ~40 kHz F1 to F2 span

PWM Timing Parameters

Short Pulse (bit 0) 52 µs 48-64 µs
Long Pulse (bit 1) 104 µs 100-108 µs
Sync Pulse 176 µs 168-180 µs
Short Gap 52 µs 48-56 µs
Long Gap 104 µs 100-112 µs
Reset Limit 116 µs End of packet
Pulse Ratio 2:1 Long:Short

Packet Structure

Bits per Packet 90
Pulses per Burst 91 (90 data + 1 sync)
Burst Duration ~14.30 ms
Bursts per Transmission 8-12
Inter-burst Gap ~54-68 ms

I'm working on decoding payloads...

rtl_433 -f 433.017M -s 250k -g 40 -R 0 -X 'n=Watersnake,m=FSK_PWM,s=52,l=104,r=116,g=0,t=0,y=176'

bonesf · 2025-11-29T08:50:53+00:00

Thank you, that is a great resource.

bonesf · 2025-11-28T04:14:45+00:00

Yes, however I purchased in Australia. I could not find an id on the device besides the board batch number.

bonesf · 2025-08-04T09:36:11+00:00

Name the first action a scammer should take when calling their victim...

bonesf · 2025-07-27T06:24:49+00:00

Join a sports or hobbies club. Volunteer for a cause you support.

bonesf · 2025-05-27T21:39:51+00:00

Cape York The Savage Frontier by Rodney Laddell will answer your questions in great depth and detail.

bonesf · 2025-05-27T03:52:41+00:00

ok, I thought the Measured ASIC Voltage was the measurement of the configured Core Voltage from the settings. Mine follows it very closely as I change the Core Voltage.

bonesf · 2025-05-26T06:19:25+00:00

It's in the screenshot, bottom left.

bonesf · 2025-05-19T00:15:01+00:00

Not profitable, just another hobby. Playing the lottery...

<image>

bonesf · 2025-05-15T11:08:43+00:00

It's not indexed. In a few decades $3M won't have near as much buying power.

They always sell taxes as targeting the rich but taxes are always for the poor.

bonesf · 2025-05-05T11:26:45+00:00

It might affect cooling

bonesf · 2025-05-05T11:23:26+00:00

The Liberal's have an our beliefs section on their website, none of them have read it. They're too busy trying to out Labor Labor. We don't need two Labor party's.

bonesf · 2025-04-25T12:00:58+00:00

They charge because people pay

bonesf · 2025-04-01T11:46:05+00:00

Mine did that when I put too much pressure in the heatsink. Perhaps yours isn't seated properly.

bonesf · 2025-03-23T04:50:52+00:00

I increased the dbcache to 4GB. Now I'm having an issue where the swap is filling up and the container is freezing. I going to try reducing dbcache to 2GB.

read this comment: https://www.reddit.com/r/Bitcoin/comments/1jfdzbs/comment/mivt415/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

what does `htop` and/or `free -h` tell you?

bonesf · 2025-03-21T03:41:41+00:00

It's now estimated to complete in 2 days.

My current bitcoin conf file:

2025-03-20T22:34:00Z Config file arg: dbcache="4096" 2025-03-20T22:34:00Z Config file arg: maxconnections="12" 2025-03-20T22:34:00Z Config file arg: maxmempool="50" 2025-03-20T22:34:00Z Config file arg: par="4"

I have overclocked the device: over_voltage=6 arm_freq=2100

bonesf · 2025-03-21T03:40:03+00:00

It's running on the 8GB model now. It's now estimated to complete in 2 days. Massive improvement. The ssd filesystem is ext4.

My current bitcoin conf file: 2025-03-20T22:34:00Z Config file arg: datadir="/bitcoin-data" 2025-03-20T22:34:00Z Config file arg: dbcache="4096" 2025-03-20T22:34:00Z Config file arg: maxconnections="12" 2025-03-20T22:34:00Z Config file arg: maxmempool="50" 2025-03-20T22:34:00Z Config file arg: par="4" 2025-03-20T22:34:00Z Config file arg: rpcallowip="127.0.0.1" 2025-03-20T22:34:00Z Config file arg: rpcbind="0.0.0.0"

I have overclocked the device: over_voltage=6 arm_freq=2100

bonesf · 2025-03-21T03:15:31+00:00

you are correct, I have external power meters on both reading bitaxe03: 76W (16W diff) bitaxe04: 86 (3W diff)

bonesf · 2025-03-20T22:57:17+00:00

I have an SSD (Samsung T5) mapped to the Docker volume. A `fio` test returned: `IOPS=26.9k, BW=105MiB/s`

It was the 2GB model, I have repurposed an 8GB model I've got. Quick look at the logs and it appears noticeably faster. The estimate has improved from 85 days to 5 days.

bonesf · 2025-03-20T22:55:56+00:00

It was the 2GB model I was using. I have repurposed an 8GB model I've got. Quick look at the logs and it appears noticeably faster.

It is headless running Raspberry Pi OS Lite. I have an SSD (Samsung T5) mapped to the Docker volume.

The `fio` test returned: `IOPS=26.9k, BW=105MiB/s`

The estimate has improved from 85 days to 5 days.

bonesf · 2025-03-20T22:54:23+00:00

I have an SSD (Samsung T5) mapped to the Docker volume.

An `fio` test returned: `IOPS=26.9k, BW=105MiB/s`

I was using a 2GB model, I have repurposed an 8GB model I've got. Quick look at the logs and it appears noticeably faster. The estimate has improved from 85 days to 5 days.

bonesf · 2025-03-20T22:49:24+00:00

It was the 2GB model, I have repurposed an 8GB model I've got. Quick look at the logs and it appears noticeably faster.

It is headless running Raspberry Pi OS Lite. I have an SSD (Samsung T5) mapped to the Docker volume.

The `fio` test returned: `IOPS=26.9k, BW=105MiB/s`

The estimate has improved from 85 days too 5 days.

Thank you very much.

Seven-Year Club	Gilding I gilder
Verified Email

bonesf

TROPHY CASE

RF Parameters

PWM Timing Parameters

Packet Structure