ADT System Retrofit

Author: Dave
Date: 11.14.23 - 10:30pm

So I have a house with an old 90s era ADT security system.

Called ADT to see how much to reactivate, they want to install a whole new system, and the monthly rate and 2 year contract is not suitable for purchase by a techie. I can create my own system for several hundred dollars, no need to get roped into their gig.

Ok so first we need to map out the wiring of whats here and determine voltages. Luckily all the wires are already run and all the door sensors are already installed.

I found an AC transformer up in the attic plugged into a receptacle. It was pretty discolored from heat with some blackening. Thats out.

The main panel was in a closet, with a battery backup, telephone line, and sensor wires.

House has 3 door switches, two motion sensors, keypad, and alarm siren.

I took down one of the motion sensors to search part numbers, they have 3 wires. Power ground and signal. The door sensors have two wires. Easy enough to map out in the panel with a continuity tester.

I powered on the system with the battery backup wires and a power supply, then measured some voltages. The keypad was receiving 5 volts, and the motion sensors were getting 12v. Tested the alarm on 5v and 12v, it has to be designed for 12v by the sound of it. No voltage markings on any of the boards :(

The keypad has 4 wires. Its a moose z900 - programming codes, more. I found some details on the z1100 keypad protocol. Probably a RS-485 multidrop. I found a guy who cut a bunch of traces and stuffed an arduino nano in (local) the housing to reuse the keypad and lights and talk to the main controller over I2C I think it was. Cant find the picture now. But that is clever.

So the wires are run, mapped out, and voltages known.

So heres my plan:

ditch the old ADT keypad and start fresh with an arduino nano and custom enclosure. takes 5v power from main board and talks to main controller over 2 wire I2C
ditch main board and use a Raspberry PI 4 with wireless and breakout shield.
replace the super old motion sensors with new microwave modules, wiring can be reused.
existing door sensors will be fine
existing siren may be fine, may replace anyway its super old but does still work.
bluetooth on the PI can probably log any device MAC address that walks into my house. that could be handy
PI will use WIFI to log events to my cloud server (custom DB and intake web api)
web server will notify me of events over email and or sms
PI heartbeat to server will allow for remote commands (disable/ enable)
on alert I suppose the heartbeat should be faster. Maybe I dont even want a local alarm, just silent.

Anyway this is the plan. Its not really an advanced project, just labor. I have already worked with all the base technologies/components. Thankfully no crawling in the attic required.

So playing around with it a bit, powering up the 5v keypad connected to my own rs485 board and an arduino did not get any reads and keypad looks like its waiting for an init message with lights cycling. I wired it up to the full SafeWatch board and it looks like it properly inits and interacts. I do not know the arm code or anything. I think I will need to sniff the data pins to analyze the protocol data for init, keystrokes etc. The keypad must have its own MCU.

The EEPROM on the main controller was socketed, it is a 93C46. I was able to find some arduino code to read it and dumped the data on a breadboard. The following is what I got:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00000000   00 00 FF 00 87 00 FF FF  CC 3F FF FC 08 02 05 34   ..ÿ.‡.ÿÿÌ?ÿü...4
00000010   05 34 23 11 0A 40 04 10  10 50 FF 1F 00 FF FF 1F   .4#..@...Pÿ..ÿÿ.
00000020   05 FF 58 92 00 00 FF 1F  01 FF 03 61 78 02 00 0A   .ÿX’..ÿ..ÿ.ax...
00000030   63 99 F0 21 34 12 77 56  40 40 50 41 41 50 2C 00   c™ð!4.wV@@PAAP,.
00000040   2C 2C 00 0A 04 04 04 04  AA 18 13 53 1F 97 FF FF   ,,......ª..S.—ÿÿ
00000050   AA 18 13 53 1F 97 FF FF  13 18 42 25 7F 55 FF FF   ª..S.—ÿÿ..B%Uÿÿ
00000060   00 01 66 7F 66 03 00 03  00 05 32 00 FF FF FF FF   ..ff.....2.ÿÿÿÿ
00000070   FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF   ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

The main program code is on another socketed eprom chip. I did find some arduino code that should be able to dump it. The processor is a 8bit TMS0C02FNL which I think IDA has a disassembler for.

I ordered a USB to RS485 connector and tried this pc based data logger. I Could not sniff any data though, so I caved and bought a saleae 8 logic analyzer. Will post updates as I experiment with it.

Realistically I could just replace the keypad completely with one of my own or a touch screen but..this is a good excuse to develop these hardware skills anyway.

I think I am going to ditch the remote wall mount keypad and just put the keypad and lcd in the closet directly connected to the raspberry pi. Im not really motivated enough to create a remote keypad/lcd/arduino nano/rs-485 terminal to save myself 5 steps to the closet. My enclosure probably wont be fancy enough to warrant such a visible location anyway. Maybe I can just add a wall mount RFID reader where the old keypad was. Shame to loose the wires completely behind a dry wall patch.

Comments: (2)

On 03.09.24 - 1:48pm Josh wrote:
Did you make any progress with the logic analyzer? Im attempting to utilize the same keypad.

On 03.09.24 - 3:54pm Dave wrote:
Hi Josh, I got side tracked on other things. I did hookup the analyzer to an arduino and rs485 module to pic and did some data sends and could see it properly, but then going back to the keypad I still couldn’t make any sense of it. Wasn’t worth the complexity to save $12 so it’s just sitting now. I decided to eliminate the remote keypad on the wall and will just put the new one in the closet on the main panel with the raspberry pi

Leave Comment:

Name:

Email: (not shown)

Message: (Required)

Math Question: 36 + 30 = ? followed by the letter: A