Author: Inderpreet Singh / Source: Hackaday
I have a home alarm system that has me wondering if I can make it better with my maker Kung-fu. Recently we had to replace our system, so I took the time to dissect the main controller, the remote sensors, and all the bits that make a home security system work.
To be precise, the subject of today’s interrogation is a Zicom brand Home Alarm that was quite famous a decade ago. It connects to a wired telephone line, takes inputs from motion, door, and gas sensors, and will make quite a racket if the system is tripped (which sometimes happened accidentally). Even though no circuits were harmed in the making of this post, I assure you that there are some interesting things that will raise an eyebrow or two. Lets take a look.
The Gateway of the Zicom Home Alarm System
The front panel is simple with a keyboard and an LCD display and a quick search on Aliexpress yields similar units still available. A number pad and a few other keys are the only way to configure the system to add sensors, set alerts, activate, and deactivate the alarm. Unfortunately there is no USB port to allow PC based configuration and the complicated process of using this gateway makes it rather user unfriendly.
Under the hood, there is a lot of classic design work to be found. Here is a list of the most prominent looking blobs on the PCB inside.
-
24C18 EEPROM [blurry]
-
Some power regulators and a standard 433MHz RF Receive Module(AM)
Lets start (guessing) from the top. The 8051 variant(1) is obvious and I guess handles the basic operations of the system. The EEPROM(2) is interesting and should be the place where the system stores configurations such as the phone numbers to be called and the ID of the sensors that have been paired with the system.
We also see a HT1380(3) serial RTC which exposes a serial interface and even though the 8051 variant does have a dedicated SPI peripheral, there are firmware tricks to bit bang effectively.
The controller should also be talking to the dedicated Holtek LCD Controller(5) via the 3 wire serial interface. Bit bang anyone? LM339s I found would be a good fit to buffer external inputs and 74HC164s serial-in-parallel-in chips are used to control wired alarms or control external relays and such.
The ST HCF4052 is an Analog Mux-Demux and was a bit of a surprise in an all digital system.
There is a DTMF decoder(7) which I assume is how a user would deactivate the alarm remotely by entering a code and then doing some other single digit commands. You don’t want your neighbors throwing rocks to silence a blaring alarm in your absence. The analog Mux-Demux could be used to switch the Decoder and dialing system to the phone lines, though relays are traditionally used for that task.
The RF part is interesting and uses what looks to be a hobby grade module which means that in order to snoop on the system, all you would need is an Arduino and a similar module. The funny thing is that the microcontroller is running at around 3 MHz and with a 6T/12T clock machine cycle. That puts the core at 250kHz…
The post Teardown: The Guts of a Digital Sentry appeared first on FeedBox.