Hello everyone,
I've recently come into possession of an old home security system, the ITI SX-V. For those interested
here is the user manual and
here is the installation manual, but in a nutshell it's a completely wireless alarm system from the late 80s, made in the USA, operating at 319.5 MHz. I think it's extremely interesting and well-made, and I'm currently working on reverse engineering the whole system (in a general sense, not exclusively at the electronics level) for my own fun, including the RF protocol, RAM contents, etc.
I'm here to ask you for some help analyzing the door/window sensors. Here is the top view of the PCB. I have attached more high resolution pictures, including the bottom view, at the end of this post.
The main problem is that sensors use a custom (?) IC and I can find no information about it online. The part number printed on it, I.T.I. 15-165 9503, brings nowhere. Ideally, I would like to learn how to program it, since programming can only be done using a custom programmer, which I don't have. My hope is that it's actually a rebranded non-proprietary IC, so I can find a datasheet with more information, but I have little knowledge in this field (I'm a computer engineer – not an electronics) and I'm not sure where to look. I couldn't find anything similar on Google, Digikey and Mouser.
It would be very helpful if any of you happens to know more about this kind of sensors or IC, recognizes it as a rebranded part, or just has an idea about how it could communicate with a programmer. I'm also very open to suggestions about what to test in order to find out more.
Here is basically everything I know about it and how it works:
- It has two reed switches (one on the left and one on the top side) to detect door opening and closing, a screw terminal (on the right) for optional external switches, and a tamper switch (to the left of the IC)
- It is programmed using a custom programmer (here is one I found on eBay) through the 5-pin connector at the center. The three parameters you can program are: house code (8 bits), sensor number (6 bits), sensor type
- It only has volatile RAM. If battery runs out, it must be reprogrammed. This is why I care about how to program it
- It sends periodic "supervisory signals" (once every 69 minutes) to the central unit reporting that it's still alive
- It's transmit-only, no RX. Since it does not receive any "ack"/confirmation from the central unit, each transmission is repeated multiple times (4x for closing, 8x for opening/tamper, 2x for supervisory signals) in order to avoid collisions and increase success probability
- The RF signal uses OOK with return-to-zero encoding
- Transmissions (only) include: house code, sensor number and sensor status (open/close, tamper switch status)
And here is the (very little) pin information I was able obtain by probing, in case it can help (I numbered pins counterclockwise starting from the top left):
- Pin 2 outputs a low-frequency version of the transmitted signal
- Pin 4 is GND
- Pin 5 outputs the sensor status (open = high, closed = low)
- Pin 6 seems to be connected with the oscillator
- Pin 8 is VCC
Thank you!