1

I'm trying to reverse engineer the protocol that an old home alarm system uses to communicate with the keypads. Connected via 4 wires:

  • GND
  • 13.2V
  • DATA
  • CLOCK

I've managed to connect the wires to a logic analyser. Here's a snapshot of a periodic data packet that it sends:

enter image description here

(Top is CLOCK and bottom is DATA)

Based on observation of the packets it appears that the first part (slower clock) is the keypad sending data to the panel and the second part is the panel reporting status (sending data to keypad).

Does this protocol look like anything standard? I've tried different analysers in the Saleae Logic software, but nothing seems to output anything meaningful.

UPDATE:

I've disconnected keypad's data and clock wires and can see that the clock and the data is generated by the panel (the output is the same as on the above screenshot).

Here's what the signal looks like on large time scale:

enter image description here

jsotola
  • 2,542
  • 3
  • 13
  • 21
Muxa
  • 161
  • 7
  • Being a security system, it is likely a proprietary protocol, so contact a security service co. – Tony Stewart EE75 Jul 01 '22 at 23:27
  • https://safehomecentral.com/identify-your-security-system-brand-and-model-by-picture/ which one? – Tony Stewart EE75 Jul 01 '22 at 23:30
  • 2
    Disconnect the clock and data lines, check to see who generates the clock (and how many pulses). Hook clock back up and check data lines Independently, post results. – Bryan Jul 01 '22 at 23:54
  • 1
    @Bryan UPDATE:

    I've disconnected keypad's data and clock wires and can see that the clock and the data is generated by the panel (the output is the same as on the above screenshot).

     – Muxa Jul 02 '22 at 01:26
  • @TonyStewartEE75 none of ones listed on that page. The alarm is New Zealand made (has "Micron Lynx v1.2" printed on the panel PCB). – Muxa Jul 02 '22 at 01:34
  • The time to reverse engineer all the functions may exceed entering 9999 codes. Buy a new controller – Tony Stewart EE75 Jul 02 '22 at 01:41
  • Now try pressing buttons to see changes in the bit pattern. Also what’s the goal? To intercept key presses or to emulate key presses? Emulating is harder because of the oddball timing and weird bit count but easily accomplished with moderate microcontroller skill. – Bryan Jul 02 '22 at 02:19

1 Answers1

4

I pressed the keypad buttons, observing light indicators on the keypad and capturing the signal using Saleae Logic software. It turned out that the protocol is dead simple: first part is a binary code for each button (8 bits) and second part is one bit per zone, light indicator and beep signal (16 bits).

I wrote a new ESPHome component to interface with the panel, so I can see the status and control the buttons.

Muxa
  • 161
  • 7
  • I have a similar Micron keypad I think. Did you ever open source your ESP code for this? I’d love to repurpose my keypad but replace the main unit with an ESP or arduino! Cheers, Ben – Ben Loveday Nov 03 '22 at 09:22
  • @BenLoveday yes I did just now: https://github.com/muxa/esphome-micron-alarm – Muxa Nov 19 '22 at 00:31