DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?

page=1

qamar
0 new
logout

Post Last post 29 posts / 0 new

Posted: Thu. Dec 6, 2012 - 06:13 AM #12

arduino_rich
Total votes: 0

riviera65 wrote:

Then, here is the Arduino code. Completely rewritten to

Level: Newbie use interrupt on pin 2 (interrupt 0), because otherwise
Joined: Thu. Dec 6, 2012
Posts: 2 View posts it seems too slow to be able to receive all messages

Thanks for your code, riviera65, I'm using it to decode my own DSC
unit, I think I have discovered some new information. I want to know
which Access code arms and disarms, and I believe the information is
encoded on the 0xA5 time/status line. Following the time are two zero
bits, then bits 41-48 seem to indicate whether a system is being armed
or disarmed, and by whom. Bits 41&42 are 0x02 for arming, and 0x03
for disarming. Subtracting 0x99 from the arming code and 0xC0 from
the disarm code reveal the Access code (01..32, and master code 40 is
represented as following duress code 34). Some examples, the first line
is the entire string, the following are just the 8 bits pointed at:

10100101 1 0001 0010 01 1100 00010 00010 010101 00 10011001

0xA5:Date:2012122 2:21 ^^^^^^
10011001 is arming, user code 01
11000000 is disarming, user code 01

1 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

10100000 is arming, user code 01

11000111 is disarming, user code 08
10111011 is arming, master code (i.e. "35")
11100010 is disarming, master code (i.e. "35")

8 bits of ones follow a user code, plus another 8 bits unless it's a master code. Both sequences are
then followed by a single bit (usually 1). I haven't been able to decode the last full byte for a user
code (preceding the 1 bit).
Can anyone duplicate these findings?

Top
Quote Reply Report

Posted: Sun. Dec 9, 2012 - 10:08 PM #13

riviera65
Total votes: 0

Hi Arduino_rich,

I reproduced your idea on my system.

Level: Newbie
Joined: Wed. Oct 31,
2012 DDDDDDDD DDDDDDDDDDDDDDDDDDDDA
Posts: 7 View posts
a5:00010010011011101101000111101110100110110000000001111111 AR
a5:00010010011011101101001000011010100110110000000010101100 AR
a5:00010010011011101101001000001110100110110000000010100000 AR
a5:00010010011011101101001000100010100110110000000010110100 AR
a5:00010010011011101101001000001100110000000000000011000011 DI
a5:00010010011011101101001000000000110000010000000010111000 DI
a5:00010010011011101101001000100000111000100000000011111001 DI

In this data, these are the a5 packets I received for different events.
The first line identifies with the D which bits are used for Date and time
(this I'm sure), The A is probably the Armed status (not completely
sure yet). But, for the remaining bits (the last eight), I can't say I'm
sure I get the same thing you do, and I'm not able to get the user
number from those. Maybe you can? I'm still trying to make sense out
of it though. I'll post other details if I finally get the enlightenment... ;)

Edit: Please disregard this example, I think I did not take the right A5
message, since when I arm the system, I get one first A5 message

2 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

when the code is entered, and then another one when the exit delay has expired and the system is
really armed. This is the second A5 that I displayed in the example above, and the first one seems
better. Here is the first one:

DDDDDDDD DDDDDDDDDDDDDDDDDDDDA
a5:00010010011011101101000111101100101111110000000010100001 BEFORE ARM user 0
a5:00010010011011101101001000011000100110010000000010101000 BEFORE ARM user 1
a5:00010010011011101101001000001100100110100000000010011101 BEFORE ARM user 2
a5:00010010011011101101001000100000101110110000000011010010 BEFORE ARM user 40

Top
Quote Reply Report

Posted: Sun. Dec 9, 2012 - 10:52 PM #14

riviera65
Total votes: 0

More info found.

DDDDDDDDPPDDDDDDDDDDDDDDDDDDDDA UUUUUU
Level: Newbie
Joined: Wed. Oct 31, a5:00010010011011101101000111101100101111110000000010100001 BE
2012
Posts: 7 View posts a5:00010010011011101101000111101110100110110000000001111111 AR
a5:00010010011011101101001000011000100110010000000010101000 BE
a5:00010010011011101101001000011010100110110000000010101100 AR
a5:00010010011011101101001000001100100110100000000010011101 BE
a5:00010010011011101101001000001110100110110000000010100000 AR
a5:00010010011011101101001000100000101110110000000011010010 BE
a5:00010010011011101101001000100010100110110000000010110100 AR
a5:00010010011011101101001000001100110000000000000011000011 DI
a5:00010010011011101101001000000000110000010000000010111000 DI
a5:00010010011011101101001000100000111000100000000011111001 DI

DDDDDDDDPPDDDDDDDDDDDDDDDDDDDDA B
a5:00010010001011101101001010100000111001111111111100111101 Ba
a5:00010010001011101101001010101100111011111111111101010001 Ba

In this data, I think I identified by PP the partition number. When this

3 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

number is partition 1, we get a user (U section) in this weird encoding that I still have to figure out
(I know you did, but I'm still stumped)

If we get partition 0, then the information is not a user but an error status (see how the B byte
could be battery error, I'll have to get more data)

The hunt continues... ;)

Top
Quote Reply Report

Posted: Mon. Dec 10, 2012 - 12:17 PM #15

Rogerbarnes
Total votes: 0

mcd1992 wrote:

I am trying to understand this protocol that my DSC

Level: Newbie
Joined: Sun. Dec 9, 2012
Posts: 3 View posts
1555 alarm uses between the base and the keypad, but
issue is its propriatary of some sorts. There was another
thread about it on this forums but it ended prematurely
with the guy just checking one bit for stay or away
mode.

From what I know about this protcol peimar led

lights(http://www.niceledlights.com) so far the
clock line runs at 1kHz with 50% duty and oddly
enough only does so for 41.6ms then it stays high for
5.4ms and starts all over again. The data line seems to
transistion on either the falling or rising edge of the
clock (or in the middle), which led Kortuk of
chiphacker.com to belive that it is NRZ encoding which
I'm not sure of yet but here are some OLS dumps of
the data and clock lines hopefully with teamwork we can
figure this out.

I'm pretty sure the data is the same as whats listed in

the PC5401 pdf below just sent via some weird protocol,
all I really need help with is figuring out whats a 1 and
whats a 0. From there I'm confident I can figure out the
rest. Thanks for your time :D

4 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

0 is the Data line, 1 is the Clock

DSC OLS Dump(http://ifile.it/25pkd3z/DSC-Keybus-Logic.zip)

ECP Patent(http://www.google.com/patents/about?id=pzwWAAAAEBAJ&
dq=patent:6868493&as_drrb_ap=q&as_minm_ap=0&as_miny_ap=&
as_maxm_ap=0&as_maxy_ap=&as_drrb_is=q&as_minm_is=0&
as_miny_is=&as_maxm_is=0&as_maxy_is=&num=10)
PC5401 Dev-PDF(http://www.baranharper.com/pdfs/dsc/pc5401-
dev_guide.pdf)
Previous AVRFreaks Thread(http://www.avrfreaks.net
/index.php?name=PNphpBB2&file=viewtopic&t=97876)

I have used system many a times but never tried to learn the protocol

Top
Quote Reply Report

Posted: Mon. Dec 10, 2012 - 07:33 PM #16

arduino_rich
Total votes: 0

Here are some code changes to the Nov 16, 2012 - 03:41 PM post
which should help with the user codes,
Add this to the end of the "if (cmd == 0xa5)" section:

Level: Newbie
Joined: Thu. Dec 6, 2012
Posts: 2 View posts

5 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

int arm = getBinaryData(stc,41,2);

int master = getBinaryData(stc,43,1);
int user = getBinaryData(stc,43,6); // 036
if (arm == 0x02) {
msg += " armed";
user = user 0x19;
}
if (arm == 0x03) {
msg += " disarmed";
}
if (arm > 0) {
if (master) msg += " master code"; else msg += " user";
user += 1; // shift to 132, 33, 34
if (user > 34) user += 5; // convert to system code 40, 41, 42
msg += " " + String(user);
}

The 0xa5 armed message is received after the exit delay when the system switches off ready to
armed. The disarm message is received immediately upon disarming. On my system I receive a
date message every four minutes regardless of arming/disarming, so disregard that one for this user
information. I think your "A" bit should be two bits long and is two bits later than your code sample.
Note that it is followed by 8 zeros and then another 8-bit message which I can't determine. Also
make sure your user codes are unique, if you post the same 4 digit pin for two user codes I believe
it only finds the first one.

add this to the "if (cmd == 0x05)" section for a possible power fail indicator:

if (getBinaryData(stc,28,1)) msg += "power fail? ";

Top
Quote Reply Report

Posted: Mon. Jan 14, 2013 - 06:09 PM #17

jolcese
Total votes: 0

Hi guys,
This is really great information. I've always wanted to interface with

6 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

the Keybus protocol.

Some questions:
Do you know if the alarm is always the "master" and keypads are
slaves?
When do slaves talk in the bus?

Level: Newbie Thanks

Joined: Mon. Jan 14, 2013
Posts: 1 View posts Jose

Top
Quote Reply Report

Posted: Sat. Mar 16, 2013 - 07:45 AM #18

jpessini
Total votes: 0

How can I write TO keybus? How to simulate a keypad sending

keystrokes to the panel?

Level: Newbie
Joined: Sat. Mar 16, 2013
Posts: 2 View posts

Top
Quote Reply Report

Posted: Sun. Apr 28, 2013 - 03:07 PM #19

fvparg
Total votes: 0

Hi,my name is Federico. i have an Logic Analizer Tektronix TLA704 in

Level: Newbie
Joined: Sun. Apr 28, 2013
Posts: 1 View posts
order to help in the proyect.
me i captured some frames the CLK and DATA for sharing.
follow in the proyect?
Thanks and I am at your disposal.

Top

7 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

Posted: Tue. May 7, 2013 - 09:51 PM #20

jpessini
Total votes: 0

This guy made a simple solution at http://www.juliano.com.br

/dsc (http://www.juliano.com.br/dsc)

Level: Newbie
Joined: Sat. Mar 16, 2013
Posts: 2 View posts

Top
Quote Reply Report

Posted: Sat. May 11, 2013 - 09:46 AM #21

Bingo600
Total votes: 0

Nice info ..
But there is no source .... Only a hex

Level: Raving Lunatic

Joined: Sun. Apr 25, 2004 Would you by any "chance" be related to "This guy" .....
Posts: 3815 View posts
Location: Denmark Your username is jpessini and http://www.juliano.com.br/(http:
//www.juliano.com.br/) refers to a Juliano Zabero Pessini

If you are .. you might ask your "relative" to release the sourcecode
:wink: :wink:

/Bingo

Top
Quote Reply Report

This is a WYSIWYG-html based editor. Please use the features in the toolbar for
formatting. The "<>" button is for the code editor.

2014 Atmel Corporation

Privacy(http://www.atmel.com/About/privacy.aspx)

8 of 9 2014-11-01 15:30
DSC Keybus Protocol | AVR Freaks http://www.avrfreaks.net/forum/dsc-keybus-protocol?page=1

Contact(http://www.atmel.com/About/contact/distributors
/default.aspx?contactType=Online%20Directory)
Site Use Terms(http://www.atmel.com/About/legal.aspx)
Cookies(http://www.atmel.com/About/cookies.aspx)

9 of 9 2014-11-01 15:30