Hacking the HKC SW812

tnegun

Hacking might be a bit strong but reverse engineering the serial I/O doesn't have the same ring to it!

I've one of these alarms at home and have a panel to play with too. I've been able to use the onboard serial port to log set/unset and alarm events out to a Raspberry Pi and can trigger emails/sms based on these evens but this far it's been passive.

I'd like to actually query the panel via the serial port for it's status and maybe see what zones are open etc. I know there was some very old software that did similar but I can't find it anymore and HKC don't return calls. Does anyone have a copy I could borrow or know anything about sending serial commands to these panels?

Thanks,
tnegun

altor

tnegun wrote: »

Hacking might be a bit strong but reverse engineering the serial I/O doesn't have the same ring to it!

I've one of these alarms at home and have a panel to play with too. I've been able to use the onboard serial port to log set/unset and alarm events out to a Raspberry Pi and can trigger emails/sms based on these evens but this far it's been passive.

I'd like to actually query the panel via the serial port for it's status and maybe see what zones are open etc. I know there was some very old software that did similar but I can't find it anymore and HKC don't return calls. Does anyone have a copy I could borrow or know anything about sending serial commands to these panels?

Thanks,
tnegun

Smartlink 7 is the tool used to do this. You need to be an installer to have access to this.
Can you not create a virtual keypad and access the system this way like what has being done with the CS350? They are using the keypad bus to do same.

tnegun

I'm just tapped into the serial port (JP2 I think) it's a 4 pin port in the middle of the board. I've tried just sending key presses but don't seem to get any feedback or response back. So I was thinking I'm using the wrong encoding or theres a handshake I'm missing.

Just found the SL7 pdf on here and that the software I was thinking of. I was thinking the keypad bus might just be serial too but haven't tried it yet. I'm only familiar with this panel but creating a virtual keypad is exactly the start i'm after as once it's programmed it should be trivial to automate functions.

It looks like there is a personal version of SL7 is this available?

KoolKid

I sent you a PM that might help

tnegun

Thanks for that

altor

tnegun wrote: »

I'm just tapped into the serial port (JP2 I think) it's a 4 pin port in the middle of the board. I've tried just sending key presses but don't seem to get any feedback or response back. So I was thinking I'm using the wrong encoding or theres a handshake I'm missing.

Just found the SL7 pdf on here and that the software I was thinking of. I was thinking the keypad bus might just be serial too but haven't tried it yet. I'm only familiar with this panel but creating a virtual keypad is exactly the start i'm after as once it's programmed it should be trivial to automate functions.

It looks like there is a personal version of SL7 is this available?

The personal version never took off so was scrapped.
Yes the keypad bus is the place to start.

tnegun

altor wrote: »

The personal version never took off so was scrapped.
Yes the keypad bus is the place to start.

I tried the keypad bus last night but just getting gibberish like I've the wrong port settings. Any idea what they should be? I'm using 2400 8N1 same as the on board port.

altor

tnegun wrote: »

I tried the keypad bus last night but just getting gibberish like I've the wrong port settings. Any idea what they should be? I'm using 2400 8N1 same as the on board port.

Haven't a clue what code they use.
I would of expected the keypad bus would of being the easier option to use.

tnegun

Looks like it might be another protocol or encoding. I'll keep tinkering and post back if I find anything. More annoying though is the real time log function doesn't appear to be real time on my panel. The spare I have for testing is from 2004 and with the real time log function enabled it writes out the events as they happen but on my panel from 2009 only writes out the event when the next one occurs e.g. If I Arm the panel the previous Unset is written out and then when I disarm the Arm is written to the serial port. I've enabled the write Line Feed option to no avail so it looks like its the firmware or another setting I've missed. Any idea if such a setting exists and can the firmware be updated?

KoolKid

Sounds interesting. Keep us updated on your progress.
I know of a few different places working on an app & interface that will work for all older systems.

altor

tnegun wrote: »

Looks like it might be another protocol or encoding. I'll keep tinkering and post back if I find anything. More annoying though is the real time log function doesn't appear to be real time on my panel. The spare I have for testing is from 2004 and with the real time log function enabled it writes out the events as they happen but on my panel from 2009 only writes out the event when the next one occurs e.g. If I Arm the panel the previous Unset is written out and then when I disarm the Arm is written to the serial port. I've enabled the write Line Feed option to no avail so it looks like its the firmware or another setting I've missed. Any idea if such a setting exists and can the firmware be updated?

Is the printer port enabled?

tnegun

Yes it's enabled and printing the engineer log or panel config works as expected its just the real time log is an event behind. The panel that works as expected is on version 7.33 this one is 7.39 and seems to have a bug. I might try power it down at the weekend and see if that resolves it. The Saab will ring when the panel looses power but should stop when I power it up right?

altor

tnegun wrote: »

Yes it's enabled and printing the engineer log or panel config works as expected its just the real time log is an event behind. The panel that works as expected is on version 7.33 this one is 7.39 and seems to have a bug. I might try power it down at the weekend and see if that resolves it. The Saab will ring when the panel looses power but should stop when I power it up right?

You could try and see if it works.
The Sabb should ring when mains and battery power have being removed but will stop once you power the system back up and turn it off with your user code.

tnegun

altor wrote: »

You could try and see if it works.
The Sabb should ring when mains and battery power have being removed but will stop once you power the system back up and turn it off with your user code.

No joy still the same after powering down the board. I'm going to swop in the spare I have anything to watch for?

tnegun

So I got it swapped in and am getting events in realtime on the printer port. I'll keep at the keypad bus and see can I make sense of it.

Gilby Dettori

Hey guys,

just wondering how you got on with this and if you have any wiring diagrams/pictures of same?

I'm hoping to integrate my alarm with my home automation system.
In particular, what I hope to achieve is;
1. The ability to query the alarm state (on/off/triggered).
2. The ability to see which zones triggered the alarm.
3. The ability to arm/disarm.

it sounds like the printer port might be able to tick #2 for me, but suspect I need the proper serial for the other requirements.

What are your thoughts?

I ultimately want to be able to have the alarm triggering invoke scenarios on my home automation;
- i.e. alarm triggers, if lumens > x then turn on flood lights on front/back of house and send push notification of zone triggered to my phones/email/etcetera.

Would really appreciate any insight you guys have!

thanks,
D.

altor

Gilby Dettori wrote: »

Hey guys,

just wondering how you got on with this and if you have any wiring diagrams/pictures of same?

I'm hoping to integrate my alarm with my home automation system.
In particular, what I hope to achieve is;
1. The ability to query the alarm state (on/off/triggered).
2. The ability to see which zones triggered the alarm.
3. The ability to arm/disarm.

it sounds like the printer port might be able to tick #2 for me, but suspect I need the proper serial for the other requirements.

What are your thoughts?

I ultimately want to be able to have the alarm triggering invoke scenarios on my home automation;
- i.e. alarm triggers, if lumens > x then turn on flood lights on front/back of house and send push notification of zone triggered to my phones/email/etcetera.

Would really appreciate any insight you guys have!

thanks,
D.

This thread might help you so

Gilby Dettori

Hey Altor,

Thanks a million for sending me in that direction.
It's funny, I've been looking around boards and was going to reach out to this guy called Altor, as he seems to know his sh*t when it came to these alarm systems... not realising it was you that actually replied to my query!

Anyhow, so... I've a few random ones for you, if you don't mind of course!

I noticed in htis specific thread, one of the guys has managed to hook his alarm up to his Raspberry Pi - wondering if either of you guys happen to have that on hand? i.e. the specific pinouts/connectivity setup?

Ideally I want to go down the same route, i.e. initially get the printer output working for realtime tracking/alerting of state. From there, I would idealy like to start enabling/disabling remotely as mentioned.

For now, I'd really settle for realtime logging, so that I can build out some phone push alerting.

Many thanks!
D.

Gilby Dettori

oh my god.... why didn't I read the entire post you sent me....

while it's not a pi, it's arduino - so might just go down that route and get an arduino.
still very interested in the pi comms setup though.

altor

Gilby Dettori wrote: »

oh my god.... why didn't I read the entire post you sent me....

while it's not a pi, it's arduino - so might just go down that route and get an arduino.
still very interested in the pi comms setup though.

Its a long thread but the last couple of pages are the HKC section

tnegun

I'm using a Raspberry Pi with a USB to Serial connection (One of these http://www.ebay.ie/itm/271496772949 as you can connect it directly to the JP2 headers on the panel board.

The panel pin out is From top
1 Vcc (12v)
2 Tx
3 Rx
4 Gnd



I run the attached perl script on the Pi and have enabled the real time log to serial printer so the Pi catches the output, Perl processes it and generates an email plus writes a confirmation to the screen.



I had problems with a newer panel in that it was realtime plus one so each event only got written to the serial port when the next came in e.g. I'd see the arm event only when the panel was unset and then the unset when then panel was next armed. I swopped in an older panel I had and the problem went away.

Vasarbob

Hi all.I'm also hoping to integrate my alarm with my home automation system. Smartthings.
Could you forward the link to the post for same. Thank you.

davehogan100

Hi Guys,

A possible suggestion would be to use a free wired zone(if you have one) and set it as an arm/disarm zone(I believe its called a key zone) and then using an output you can open and close it. I have not attempted it on a hkc panel yet but I believe open = armed closed = disarmed. The only thing is you need to make sure any code you write to access the output trigger is secure as otherwise someone could potentially disarm your system remotely.

Regarding the output as stated above you can just use the serial port with a Pi.

tnegun

The Pi should be able to drive a relay acting and this could be wired to a key zone allowing remote arming and disarming of the system. There's another thread on here for a remote key pad which might be a tidyer solution. You should be able to use the onboard serial of the Pi to do the same as the USB adaptor too.

fbradyirl

Hi guys, just wondering how you got on with this? I have this same system

Model : HKC SW812
Version 7.36 May 07

and I already own a raspberry pi (which I use to run Home Assistant), and it would be great if I could get notified of activity on the alarm.

tnegun, from what I am reading, if I simply get that USB to serial cable (which I have just ordered from the uk) and attach it to the panel and the Pi,

1. Will I be able to get notifications of arming etc using your perl script?
2. How are you powering the Raspberry Pi in your setup?
3. Do I need the engineer code for this setup? I do not have this.

fbradyirl

tnegun wrote: »

I'm using a Raspberry Pi with a USB to Serial connection (One of these http://www.ebay.ie/itm/271496772949 as you can connect it directly to the JP2 headers on the panel board.

The panel pin out is From top
1 Vcc (12v)
2 Tx
3 Rx
4 Gnd



I run the attached perl script on the Pi and have enabled the real time log to serial printer so the Pi catches the output, Perl processes it and generates an email plus writes a confirmation to the screen.



I had problems with a newer panel in that it was realtime plus one so each event only got written to the serial port when the next came in e.g. I'd see the arm event only when the panel was unset and then the unset when then panel was next armed. I swopped in an older panel I had and the problem went away.

I have created a python version of your perl script & instead of email, I am using PushBullet to notify me via the iOS App.

https://gist.github.com/fbradyirl/b8614554822e39a323cd1f7daafa5a36

tnegun

fbradyirl wrote: »

Hi guys, just wondering how you got on with this? I have this same system

Model : HKC SW812
Version 7.36 May 07

and I already own a raspberry pi (which I use to run Home Assistant), and it would be great if I could get notified of activity on the alarm.

tnegun, from what I am reading, if I simply get that USB to serial cable (which I have just ordered from the uk) and attach it to the panel and the Pi,

1. Will I be able to get notifications of arming etc using your perl script?
2. How are you powering the Raspberry Pi in your setup?
3. Do I need the engineer code for this setup? I do not have this.

Yes the USB cable just plugs onto the JP2 headers and all events are written to the serial port. I had the Pi in the panel for a while and powered it using a 12v to 5v dc converter from the 12v supply inside the panel. I've since moved it about 20-30 meters away and am using an unused pair in a zone wire to bring the serial out to the Pi. I think you will need the engineer code to enable events to be written to the serial port as you have to tell the panel that a serial printer is attached.

fbradyirl

Right thanks for the info. I don't have the engineer code. Do you know the instructions to default the 812 panel?

tnegun

PM me your email and I'll send you the installers manual. Theres a bit in it it as you will have to reconfigure the panel. If its not engineer locked its just a matter of powering down the panel, removing a jumper, powering up again and reconfiguring the panel from defaults. If it is locked one of the regulars here might be able to help

dauhee

tnegun wrote: »

The Pi should be able to drive a relay acting and this could be wired to a key zone allowing remote arming and disarming of the system. There's another thread on here for a remote key pad which might be a tidyer solution. You should be able to use the onboard serial of the Pi to do the same as the USB adaptor too.

Absolutely fantastic work from everyone that has contributed Using the key zone type is the final piece of the puzzle for arm/disarm


just to confirm did you just connect the Tx/Rx direct from JP2 to the pi for serial (and not Vcc or Gnd)? (Not wishing to fry the 3.3v GPIO with 12v). I have a TTL usb to serial which can use but if can get away without would rather that.


Will be using lite OS on the pi so less things to bring it down, and get stuff in/out via an instant messaging app, one with siri integration so I can voice command arm/disarm, just because.

tnegun

I'd have to look back at it again as it's been in place a long time! From memory I think you have to connect all 4 so that the electric potential is the same between the Pi and the Panel or you won't be able to properly read the serial output.

Read back over the thread and I definitely have all 4 connected.

dauhee

tnegun wrote: »

I'm using a Raspberry Pi with a USB to Serial connection (One of these http://www.ebay.ie/itm/271496772949 as you can connect it directly to the JP2 headers on the panel board.

The panel pin out is From top
1 Vcc (12v)
2 Tx
3 Rx
4 Gnd

It would be great if you got a chance to check. I've no electrical skills and can't get my head around the USB to Serial being rated for 5v but the Vcc on JP2 is 12v as you mentioned. Does the PL2303HX chip in the USB To RS232 cable do some shifting of signal voltage?

reading the serial events would be perfect for me, as tapping into the keypad solution on another thread gives me palpitations with all the wiring.

tnegun

Just opened the panel and all I have connected is the Ground and TX pins so 2nd from the top and the last. It makes sense as we don't need the Vcc or the RX pins as we're only passively monitoring it.

dauhee

much appreciated for that. Yeah that makes sense reading passively Tx pin and not taking 12v. I'm on ver 7.39 panel, so might have to raise a dummy event on the panel each time a message comes through (as you mentioned appears to be sending messages realtime -1), but should be good to go now, thanks.

for anyone interested, my planned config will be:
-raspberry pi zero w
-Raspbian Buster Lite configured for power save (might have a play round with other minimal OSs like piCore or give windows IoT a go)
-python app
-controlled not by web page but watsapp message (wanted to use telegram but integration to siri not great)
-https web site used as local command and control for all my sonoff stuff (paired to my web site and not the itlead hosted site)
-gsm stick to notify of mains power failure (will be using running of the 12v battery)

tnegun

Post back how you get on I haven't looked at this in years as it's been so stable and just works but upgrading from email notifications to whatsapp I'd be very interested in!

dauhee

got a little delivery in the post yesterday (RS232 TTL UART PL2303HX cable) so am going to start on this now. going to take the 12v and have a dc stepper (actually its a UBEC) for 5v which will power on the Pi pins direct - it bypasses the polyfuse but the supply is good from the panel

I'm just dumping out some stuff in case it is of interest to anyone:

Whatsapp was a bit hacky to automate so am using a telegram bot, more secure and functionality anyhow, just doesn't play ball with siri. I give it markup so essentially created my custom buttons that the bot picks up and actions. Its great and works very well. I don't have any external ports on my internet so its my only way to get in. I did evaluate hosted MQTT brokers and looked at various options to connect to my pi. I tried the azure implementation which isn't full adherance from what I can remember, but it was in my opinion the best for being free and low chance of it being decommissioned in a year or 2. In the end though, I didn't want my system to be paralized if the internet went down, and also have a few different things going on and wanted flexibility

So I have my internal website on lighttd, I might see about getting a port opened up so can access externally, use noIP.

I have RCSwitch library to control my 433.92Mhz switches for lights, for some more serious stuff that needed to be sure they were going on/off (like heating), am using sonoff switches - the pysonofflanr3 pythong library works great for those. Is great as can get full control of heating without need to buy nest/climote/etc device (with no yearly maintain fee also).

I also use RCSwitch for a CAME gate (card is Za3) - had to add a new protocol for RCSwitch to understand the CAME timings- I was planning to use an ESP chip with relay, which I might still do, to watch IR break beam and set off an alert if the gate doesn't open within 30 seconds, and/or turn on lights when gate opens if its dark. there is a mix of 24v DC and AC for some reason, so the solution requires optocoupler to detect 24v DC which works well, relay to open gate (24v AC), and hall current sensor (I think) to detect when when a 24v AC signal is on

I also pull XML from Met Eireann to monitor short term forecast for rain, temp, cloud etc

I used python lib suntime to get sunrise/set

So I have good control over the home and can do different things based on times/values/events

I'm also looking to purchase pv solar panels - the ginlong inverter seems to be the one uses which is good as there are a couple python scripts to obtain data from it, so will be able to detect if is on grid/battery/panel and take action by turning stuff on/off

The security system will be a big piece of the puzzle, so hopefully can get to grips with serial data. electronics isn't my strong point, so the hooking up as keypad in the panel isn't my first choice. Hopefully I will be able to report some success in the next week

dauhee

The power from the board is well sufficient for a pi, and runs fine when mains is removed. I will configure an unused zone for "Mains Dly" output so that if the system goes on battery, it will use GSM stick to send a text (also using that in case telegram/internet is down) - using gsmmodem.modem python library

The serial port is singing a merry tune and I've been getting all the alerts from arming and disarming manually etc. Its actually very handy as can print out the HKC config and keep as a backup in case need to resetup again in future.

Am going to set an unused zone as key (with pulse) so that can remotely arm/disarm. One thing I couldn't figure out to do is do "part set" as key zone is just a full arm. I was having a crisis and thinking I had to go with the key bus hack, but think what can do is put another relay on the landing in NO, but close it which will effectively disable it and get the same result as part set.

again, just jotting stuff down in case anyone ever has any use for it

Vasarbob

Hi tnegun,

Could you tell me what the baud rate is for the printer port on the hkc panel. does it show zones open etc. on the printer port. Did you try to use and arduino or esp to read the port or have you just used a pi .thank you

tnegun

Serial port setup I'm using is 2400 8n1, its a PI with a USB2Serial adapter plugged straight into the board. Its doesn't report zone status just unset/set events, alarm events and triggers, mains faults etc.

Kenny Powers

Did anyone get this fully working with arm disarm or even panic alarm? Would you mind sharing the code etc? Wouldn't mind giving this a try on my HKC alarm

Thank you