Hacking the HKC SW812

tnegun

Hacking might be a bit strong but reverse engineering the serial I/O doesn't have the same ring to it!

I've one of these alarms at home and have a panel to play with too. I've been able to use the onboard serial port to log set/unset and alarm events out to a Raspberry Pi and can trigger emails/sms based on these evens but this far it's been passive.

I'd like to actually query the panel via the serial port for it's status and maybe see what zones are open etc. I know there was some very old software that did similar but I can't find it anymore and HKC don't return calls. Does anyone have a copy I could borrow or know anything about sending serial commands to these panels?

Thanks,
tnegun

altor

tnegun wrote: »

Hacking might be a bit strong but reverse engineering the serial I/O doesn't have the same ring to it!

I've one of these alarms at home and have a panel to play with too. I've been able to use the onboard serial port to log set/unset and alarm events out to a Raspberry Pi and can trigger emails/sms based on these evens but this far it's been passive.

I'd like to actually query the panel via the serial port for it's status and maybe see what zones are open etc. I know there was some very old software that did similar but I can't find it anymore and HKC don't return calls. Does anyone have a copy I could borrow or know anything about sending serial commands to these panels?

Thanks,
tnegun

Smartlink 7 is the tool used to do this. You need to be an installer to have access to this.
Can you not create a virtual keypad and access the system this way like what has being done with the CS350? They are using the keypad bus to do same.

tnegun

I'm just tapped into the serial port (JP2 I think) it's a 4 pin port in the middle of the board. I've tried just sending key presses but don't seem to get any feedback or response back. So I was thinking I'm using the wrong encoding or theres a handshake I'm missing.

Just found the SL7 pdf on here and that the software I was thinking of. I was thinking the keypad bus might just be serial too but haven't tried it yet. I'm only familiar with this panel but creating a virtual keypad is exactly the start i'm after as once it's programmed it should be trivial to automate functions.

It looks like there is a personal version of SL7 is this available?

KoolKid

I sent you a PM that might help

tnegun

Thanks for that

altor

tnegun wrote: »

I'm just tapped into the serial port (JP2 I think) it's a 4 pin port in the middle of the board. I've tried just sending key presses but don't seem to get any feedback or response back. So I was thinking I'm using the wrong encoding or theres a handshake I'm missing.

Just found the SL7 pdf on here and that the software I was thinking of. I was thinking the keypad bus might just be serial too but haven't tried it yet. I'm only familiar with this panel but creating a virtual keypad is exactly the start i'm after as once it's programmed it should be trivial to automate functions.

It looks like there is a personal version of SL7 is this available?

The personal version never took off so was scrapped.
Yes the keypad bus is the place to start.

tnegun

altor wrote: »

The personal version never took off so was scrapped.
Yes the keypad bus is the place to start.

I tried the keypad bus last night but just getting gibberish like I've the wrong port settings. Any idea what they should be? I'm using 2400 8N1 same as the on board port.

altor

tnegun wrote: »

I tried the keypad bus last night but just getting gibberish like I've the wrong port settings. Any idea what they should be? I'm using 2400 8N1 same as the on board port.

Haven't a clue what code they use.
I would of expected the keypad bus would of being the easier option to use.

tnegun

Looks like it might be another protocol or encoding. I'll keep tinkering and post back if I find anything. More annoying though is the real time log function doesn't appear to be real time on my panel. The spare I have for testing is from 2004 and with the real time log function enabled it writes out the events as they happen but on my panel from 2009 only writes out the event when the next one occurs e.g. If I Arm the panel the previous Unset is written out and then when I disarm the Arm is written to the serial port. I've enabled the write Line Feed option to no avail so it looks like its the firmware or another setting I've missed. Any idea if such a setting exists and can the firmware be updated?

KoolKid

Sounds interesting. Keep us updated on your progress.
I know of a few different places working on an app & interface that will work for all older systems.

altor

tnegun wrote: »

Looks like it might be another protocol or encoding. I'll keep tinkering and post back if I find anything. More annoying though is the real time log function doesn't appear to be real time on my panel. The spare I have for testing is from 2004 and with the real time log function enabled it writes out the events as they happen but on my panel from 2009 only writes out the event when the next one occurs e.g. If I Arm the panel the previous Unset is written out and then when I disarm the Arm is written to the serial port. I've enabled the write Line Feed option to no avail so it looks like its the firmware or another setting I've missed. Any idea if such a setting exists and can the firmware be updated?

Is the printer port enabled?

tnegun

Yes it's enabled and printing the engineer log or panel config works as expected its just the real time log is an event behind. The panel that works as expected is on version 7.33 this one is 7.39 and seems to have a bug. I might try power it down at the weekend and see if that resolves it. The Saab will ring when the panel looses power but should stop when I power it up right?

altor

tnegun wrote: »

Yes it's enabled and printing the engineer log or panel config works as expected its just the real time log is an event behind. The panel that works as expected is on version 7.33 this one is 7.39 and seems to have a bug. I might try power it down at the weekend and see if that resolves it. The Saab will ring when the panel looses power but should stop when I power it up right?

You could try and see if it works.
The Sabb should ring when mains and battery power have being removed but will stop once you power the system back up and turn it off with your user code.

tnegun

altor wrote: »

You could try and see if it works.
The Sabb should ring when mains and battery power have being removed but will stop once you power the system back up and turn it off with your user code.

No joy still the same after powering down the board. I'm going to swop in the spare I have anything to watch for?

tnegun

So I got it swapped in and am getting events in realtime on the printer port. I'll keep at the keypad bus and see can I make sense of it.

Gilby Dettori

Hey guys,

just wondering how you got on with this and if you have any wiring diagrams/pictures of same?

I'm hoping to integrate my alarm with my home automation system.
In particular, what I hope to achieve is;
1. The ability to query the alarm state (on/off/triggered).
2. The ability to see which zones triggered the alarm.
3. The ability to arm/disarm.

it sounds like the printer port might be able to tick #2 for me, but suspect I need the proper serial for the other requirements.

What are your thoughts?

I ultimately want to be able to have the alarm triggering invoke scenarios on my home automation;
- i.e. alarm triggers, if lumens > x then turn on flood lights on front/back of house and send push notification of zone triggered to my phones/email/etcetera.

Would really appreciate any insight you guys have!

thanks,
D.

altor

Gilby Dettori wrote: »

Hey guys,

just wondering how you got on with this and if you have any wiring diagrams/pictures of same?

I'm hoping to integrate my alarm with my home automation system.
In particular, what I hope to achieve is;
1. The ability to query the alarm state (on/off/triggered).
2. The ability to see which zones triggered the alarm.
3. The ability to arm/disarm.

it sounds like the printer port might be able to tick #2 for me, but suspect I need the proper serial for the other requirements.

What are your thoughts?

I ultimately want to be able to have the alarm triggering invoke scenarios on my home automation;
- i.e. alarm triggers, if lumens > x then turn on flood lights on front/back of house and send push notification of zone triggered to my phones/email/etcetera.

Would really appreciate any insight you guys have!

thanks,
D.

This thread might help you so

Gilby Dettori

Hey Altor,

Thanks a million for sending me in that direction.
It's funny, I've been looking around boards and was going to reach out to this guy called Altor, as he seems to know his sh*t when it came to these alarm systems... not realising it was you that actually replied to my query!

Anyhow, so... I've a few random ones for you, if you don't mind of course!

I noticed in htis specific thread, one of the guys has managed to hook his alarm up to his Raspberry Pi - wondering if either of you guys happen to have that on hand? i.e. the specific pinouts/connectivity setup?

Ideally I want to go down the same route, i.e. initially get the printer output working for realtime tracking/alerting of state. From there, I would idealy like to start enabling/disabling remotely as mentioned.

For now, I'd really settle for realtime logging, so that I can build out some phone push alerting.

Many thanks!
D.

Gilby Dettori

oh my god.... why didn't I read the entire post you sent me....

while it's not a pi, it's arduino - so might just go down that route and get an arduino.
still very interested in the pi comms setup though.

altor

Gilby Dettori wrote: »

oh my god.... why didn't I read the entire post you sent me....

while it's not a pi, it's arduino - so might just go down that route and get an arduino.
still very interested in the pi comms setup though.

Its a long thread but the last couple of pages are the HKC section

tnegun

I'm using a Raspberry Pi with a USB to Serial connection (One of these http://www.ebay.ie/itm/271496772949 as you can connect it directly to the JP2 headers on the panel board.

The panel pin out is From top
1 Vcc (12v)
2 Tx
3 Rx
4 Gnd



I run the attached perl script on the Pi and have enabled the real time log to serial printer so the Pi catches the output, Perl processes it and generates an email plus writes a confirmation to the screen.



I had problems with a newer panel in that it was realtime plus one so each event only got written to the serial port when the next came in e.g. I'd see the arm event only when the panel was unset and then the unset when then panel was next armed. I swopped in an older panel I had and the problem went away.

Vasarbob

Hi all.I'm also hoping to integrate my alarm with my home automation system. Smartthings.
Could you forward the link to the post for same. Thank you.

davehogan100

Hi Guys,

A possible suggestion would be to use a free wired zone(if you have one) and set it as an arm/disarm zone(I believe its called a key zone) and then using an output you can open and close it. I have not attempted it on a hkc panel yet but I believe open = armed closed = disarmed. The only thing is you need to make sure any code you write to access the output trigger is secure as otherwise someone could potentially disarm your system remotely.

Regarding the output as stated above you can just use the serial port with a Pi.

tnegun

The Pi should be able to drive a relay acting and this could be wired to a key zone allowing remote arming and disarming of the system. There's another thread on here for a remote key pad which might be a tidyer solution. You should be able to use the onboard serial of the Pi to do the same as the USB adaptor too.

fbradyirl

Hi guys, just wondering how you got on with this? I have this same system

Model : HKC SW812
Version 7.36 May 07

and I already own a raspberry pi (which I use to run Home Assistant), and it would be great if I could get notified of activity on the alarm.

tnegun, from what I am reading, if I simply get that USB to serial cable (which I have just ordered from the uk) and attach it to the panel and the Pi,

1. Will I be able to get notifications of arming etc using your perl script?
2. How are you powering the Raspberry Pi in your setup?
3. Do I need the engineer code for this setup? I do not have this.

fbradyirl

tnegun wrote: »

I'm using a Raspberry Pi with a USB to Serial connection (One of these http://www.ebay.ie/itm/271496772949 as you can connect it directly to the JP2 headers on the panel board.

The panel pin out is From top
1 Vcc (12v)
2 Tx
3 Rx
4 Gnd



I run the attached perl script on the Pi and have enabled the real time log to serial printer so the Pi catches the output, Perl processes it and generates an email plus writes a confirmation to the screen.



I had problems with a newer panel in that it was realtime plus one so each event only got written to the serial port when the next came in e.g. I'd see the arm event only when the panel was unset and then the unset when then panel was next armed. I swopped in an older panel I had and the problem went away.

I have created a python version of your perl script & instead of email, I am using PushBullet to notify me via the iOS App.

https://gist.github.com/fbradyirl/b8614554822e39a323cd1f7daafa5a36

tnegun

fbradyirl wrote: »

Hi guys, just wondering how you got on with this? I have this same system

Model : HKC SW812
Version 7.36 May 07

and I already own a raspberry pi (which I use to run Home Assistant), and it would be great if I could get notified of activity on the alarm.

tnegun, from what I am reading, if I simply get that USB to serial cable (which I have just ordered from the uk) and attach it to the panel and the Pi,

1. Will I be able to get notifications of arming etc using your perl script?
2. How are you powering the Raspberry Pi in your setup?
3. Do I need the engineer code for this setup? I do not have this.

Yes the USB cable just plugs onto the JP2 headers and all events are written to the serial port. I had the Pi in the panel for a while and powered it using a 12v to 5v dc converter from the 12v supply inside the panel. I've since moved it about 20-30 meters away and am using an unused pair in a zone wire to bring the serial out to the Pi. I think you will need the engineer code to enable events to be written to the serial port as you have to tell the panel that a serial printer is attached.

fbradyirl

Right thanks for the info. I don't have the engineer code. Do you know the instructions to default the 812 panel?

tnegun

PM me your email and I'll send you the installers manual. Theres a bit in it it as you will have to reconfigure the panel. If its not engineer locked its just a matter of powering down the panel, removing a jumper, powering up again and reconfiguring the panel from defaults. If it is locked one of the regulars here might be able to help

dauhee

tnegun wrote: »

The Pi should be able to drive a relay acting and this could be wired to a key zone allowing remote arming and disarming of the system. There's another thread on here for a remote key pad which might be a tidyer solution. You should be able to use the onboard serial of the Pi to do the same as the USB adaptor too.

Absolutely fantastic work from everyone that has contributed Using the key zone type is the final piece of the puzzle for arm/disarm


just to confirm did you just connect the Tx/Rx direct from JP2 to the pi for serial (and not Vcc or Gnd)? (Not wishing to fry the 3.3v GPIO with 12v). I have a TTL usb to serial which can use but if can get away without would rather that.


Will be using lite OS on the pi so less things to bring it down, and get stuff in/out via an instant messaging app, one with siri integration so I can voice command arm/disarm, just because.

tnegun

I'd have to look back at it again as it's been in place a long time! From memory I think you have to connect all 4 so that the electric potential is the same between the Pi and the Panel or you won't be able to properly read the serial output.

Read back over the thread and I definitely have all 4 connected.