Ademco | Help with Ademco Keybus protocols

[Bradly]

I currently have a Radio Primary (back up) solution that has full reporting capabilities with DSC and Visonic.  It will work with Ademco however on on a universal level (not full reporting).  Ademco loves thier Alarm net solution and why not it's a good product however in saying that trying to get the protocol is like pulling teeth sooooooo... can any one help Im sure it's out there I just have no idea where to look. Many thanks,
Brad

[hokie21]

The bus is called the Ademco ECP bus. It is proprietary to Ademco. Ademco has some patents that will give you some clues, if you want to attempt to reverse engineer it. Check out US patent 6,868,493 for a good start. It appears to use 5V TTL levels with an RS-232 UART at 4800 bps. Please share what you learn.

[Bradly]

Thanks Hokie 21.  I would be more than Happy to share. If you have a spare sec give me a shout I am at 1-800-246-1914

all the best,
Brad

[chanceu]

Out of curiosity, how did you determine the ECP bus is RS-232?

I ask for 2 reasons:

1-The patent you reference does't really describe anything about the ECP bus except the byte format (1 stop bit, 8 data bits, 1 parity bit, 2 stop bits).

2-RS-232 isn't really effective at distances over about 10 feet. I would guess something more like RS-485 because of the distances between devices in a typical alarm.

Chance

[hokie21]

It uses a UART like is used with RS-232, but it isn't actually RS-232. The signal actually goes between 0 and 12v so the signal levels technically aren't RS-232, RS-485 or anything else. I don't know where you came up with RS-232 only goes ten feet. This reference says that the max length for 4800 bps is 1000' http://www.lammertbies.nl/comm/info/RS-232_specs.html. This reference says that the max length for 4800 bps is 250' http://www.taltech.com/TALtech_web/resources/intro-sc.html.

I built a little optoisolator interface and hooked the ECP bus up to an RS-232 protocol analyzer. I could easily read the ASCII text messages being sent to the alpha keypads for display.

John

[chanceu]

UART doesn't mean RS-232. UART's are also used for RS-485, RS-422, and several others. As a matter of fact, one UART can be used for multiple protocols. I use a PCI serial card that supports RS-232, RS-485, and RS-422 and uses a 16950 UART to monitor an IBM 485 bus.

I didn't say it only goes 10 feet, but with typical quality cable, it wouldn't be too reliable in much longer runs. I believe a RS-232 could propigate over the length of cable used in most security systems, but I wouldn't want to pay the price for the quality of cable needed to make it reliable. Especially if most installations are like mine where the alarm cables run across and next to electric lines or whatever else happens to be in the way.

I'm not trying to start an argument about this. I am really interested in finding this information. The only reason I asked the question is I have never seen anything that uses an RS-232 multi-point network that isn't daisy chained.

I am interested in this optoisolator you built. All I really want is something that I can connect to the alarm and see the data going across the bus. If you were able to get an RS-232 signal off the ECP bus and see meaningful data, that's all I'm really looking for.

[messi]

Hi everyone.

This thread is cool. I have got a similar problem.
I would like to build an adapterbox between my Vista-20P and an external GSM-Module.
 Now when an alarm occures my box should send the alarmtext from the Vista-20 to the GSM module.

I'm also very interested in optoisolator interface from John.

What component did you take?

Thanks for helping.

Regards

J

[hokie21]

Here is a drawing of the ECP to RS232 interface I put together.
http://gilbert.homeip.net/ecp.pdf

[messi]

Thats cool. Thanks hokie21.

I have already started to make a module which can be easily hook up.
I have ordered from www.olimex.com the board LPC_P2103.

It is a development board with an ARM7 processor. This processor has got two UARTS and a lot more peripherials. It's quite cheap around 40$.

I hope that I will receive my board next week.

If I got any news I will post it.

Cheers

J



 

[hokie21]

Very good. Keep us posted on your progress and what you are able to figure out with the protocol.

John

[messi]

Hi everyone.
I have rebuild the ECP to RS232 converter. It works!
port settings 4800,8,odd,2
I received various messages like alarm, sabotage and open. I will start to analyze the messages protocol.
Cheers J

[peterpan]

Here is my experience with the Ademco keybus till date:

1. It is a UART protocol similar to RS-232. However since many devices can sit on the bus it seems to use polling (patent 6868493). Has anybody figured out how many devices can talk at the same time - for eg a keypad and a Zone expander?

2. The perpheral devices talk ONLY when an action is taken or when an alarm occurs or keep alive messages.

3. The control panel is very chatty and keeps the bus busy with data.

4. I am using 4800, 8D, 2Stop, Even parity for both Data in and Data out of panel. However not all data analysed is without error.

Question:

Has anybody found the details of the messages sent by the Vista20P control panel? If you have please shed some light on your findings.

Peter

[messi]

Hi Peter

I have analyzed the protocol too. I think the answers lies in the drawings of the patent.
Unfortunately I could make the drawings of the online patent visible.

I think the messages and the protocol should be described there too.

I have finished my adapter board. When one of my relays will be activated I will start scanning the bytestream for keyword like "Alarm", "Open" or "Sabotage"

Then I will send a mssage to my GSM to send a SMS with the right text.

I will keep you inform of my progress.

Cheers

J
 

[chanceu]

If in fact the controller does poll each device, the question you ask in #1 is also answered in #1. If polling in this network works like other networks I've worked on, the controller polls a device, waits some length of time for a response, then moves on to the next device. This would seem to be evident by the amount of activity you're seeing (#3). To eliminate collisions, devices built for a polled networks are designed so they won't put anything on the network until the controller polls it.

Are you seeing any meaningful data in the stream? I would think that if you press a key on the keypad, you should see some activity that is out of the ordinary from normal polling. I would also guess that somewhere in or ahead of that data you would see the keypads address either sent by the controller or the keypad.

[chanceu]

I think the answers lies in the drawings of the patent.
Unfortunately I could make the drawings of the online patent visible.

One thing to keep in mind about that US Patent #6,868,493 describes a method for communicating between multiple control panels and not communicating between a control panel and the devices connected to it.

However, if you think the pictures will help, go to www.uspto.gov. Click "patents" in the left column, click "search", and use the patent number as the search term. At the top or bottom of the patent page, click "images". When the images page appears, click "help" in the upper right. From the help page, click "how to access patent full-page images". From there, take your pick of the viewers. I've successfully used interneTIFF in both IE 7 and FireFox 1.5.

This gets you the images, but I haven't found anything usefull in them.

Good luck!