433MHz door contacts communications protocol

I purchased some generic 433MHz door contacts, which are connected via rtl_433, and published to mqtt via JSON.

I have them working in HA, but I’m wondering if anyone has a reference for what the data they send (specifically tristate and cmd) means?


I have four sensors, and two happen to have the same ID. Here’s the 4 of them each sending on (open):

{"time":"2021-07-20 23:33:50","model":"Generic-Remote","id":10558,"cmd":99, "tristate":"0XXZ011XZX01"}
{"time":"2021-07-20 23:35:38","model":"Generic-Remote","id":10566,"cmd":179,"tristate":"0XXZZ0ZXX101"}
{"time":"2021-07-20 23:32:59","model":"Generic-Remote","id":10884,"cmd":147,"tristate":"0XXXX0Z0XZ01"}
{"time":"2021-07-20 23:40:34","model":"Generic-Remote","id":10884,"cmd":131,"tristate":"0XXXX0Z0X001"}

and off (closed):

{"time":"2021-07-20 23:35:10","model":"Generic-Remote","id":10558,"cmd":105,"tristate":"0XXZ011XZXXZ"}
{"time":"2021-07-20 23:35:53","model":"Generic-Remote","id":10566,"cmd":185,"tristate":"0XXZZ0ZXX1XZ"}
{"time":"2021-07-20 23:33:12","model":"Generic-Remote","id":10884,"cmd":153,"tristate":"0XXXX0Z0XZXZ"}
{"time":"2021-07-20 23:41:08","model":"Generic-Remote","id":10884,"cmd":137,"tristate":"0XXXX0Z0X0XZ"}

It’s interesting to see laid out another way:

ID 10558 ID 10566 ID 10884 ID 10884
tristate ON 0XXZ011XZX01 0XXZZ0ZXX101 0XXXX0Z0XZ01 0XXXX0Z0X001
tristate OFF 0XXZ011XZXXZ 0XXZZ0ZXX1XZ 0XXXX0Z0XZXZ 0XXXX0Z0X0XZ
cmd ON 0x63 0xB3 0x93 0x83
cmd OFF 0x69 0xB9 0x99 0x89
  • tristate ending in 01 seems to be ON, and ending in XZ is off … but I don’t know what the rest means.
    • Anything else useful encoded in there, like “battery low”?
  • For cmd, 0x3 seems to be on and 0x9 is off
  • The the first nibble of cmd is at constant for the sensor – but what’s the purpose of this?
    • This worked out for me in that I can tell the difference between the two sensors with the same id… but if that’s the purpose, why not just make the ID bigger?

Has anyone worked out what everything in tristate actually means? Any ideas on what’s going on with cmd?

You might get a better answer from the rtl_433 forum, since that’s the software translating your signals.

I picked up the same sensors. Any luck?

I never pursued this further, but I still have these sensors around, they’re still working.

Biggest downside is if the signal is weak, you’ll miss the open/close event and just never know. Same thing if the battery dies: they’ll first start being unreliable as the signal is weaker, then they’ll just stop working.

One experiment I did this year was to coat the board in one with clear nail polish in an attempt to water-proof it, and now have it outside attached to a gate. It’s been working ok for the past few months.