Electronics > RF, Microwave, Ham Radio

Reverse engineering an old (late 80s) wireless alarm sensor IC

(1/2) > >>

elidcoif:
Hello everyone,

I've recently come into possession of an old home security system, the ITI SX-V. For those interested here is the user manual and here is the installation manual, but in a nutshell it's a completely wireless alarm system from the late 80s, made in the USA, operating at 319.5 MHz. I think it's extremely interesting and well-made, and I'm currently working on reverse engineering the whole system (in a general sense, not exclusively at the electronics level) for my own fun, including the RF protocol, RAM contents, etc.

I'm here to ask you for some help analyzing the door/window sensors. Here is the top view of the PCB. I have attached more high resolution pictures, including the bottom view, at the end of this post.



The main problem is that sensors use a custom (?) IC and I can find no information about it online. The part number printed on it, I.T.I. 15-165 9503, brings nowhere. Ideally, I would like to learn how to program it, since programming can only be done using a custom programmer, which I don't have. My hope is that it's actually a rebranded non-proprietary IC, so I can find a datasheet with more information, but I have little knowledge in this field (I'm a computer engineer – not an electronics) and I'm not sure where to look. I couldn't find anything similar on Google, Digikey and Mouser.

It would be very helpful if any of you happens to know more about this kind of sensors or IC, recognizes it as a rebranded part, or just has an idea about how it could communicate with a programmer. I'm also very open to suggestions about what to test in order to find out more.

Here is basically everything I know about it and how it works:

* It has two reed switches (one on the left and one on the top side) to detect door opening and closing, a screw terminal (on the right) for optional external switches, and a tamper switch (to the left of the IC)
* It is programmed using a custom programmer (here is one I found on eBay) through the 5-pin connector at the center. The three parameters you can program are: house code (8 bits), sensor number (6 bits), sensor type
* It only has volatile RAM. If battery runs out, it must be reprogrammed. This is why I care about how to program it
* It sends periodic "supervisory signals" (once every 69 minutes) to the central unit reporting that it's still alive
* It's transmit-only, no RX. Since it does not receive any "ack"/confirmation from the central unit, each transmission is repeated multiple times (4x for closing, 8x for opening/tamper, 2x for supervisory signals) in order to avoid collisions and increase success probability
* The RF signal uses OOK with return-to-zero encoding
* Transmissions (only) include: house code, sensor number and sensor status (open/close, tamper switch status)And here is the (very little) pin information I was able obtain by probing, in case it can help (I numbered pins counterclockwise starting from the top left):

* Pin 2 outputs a low-frequency version of the transmitted signal
* Pin 4 is GND
* Pin 5 outputs the sensor status (open = high, closed = low)
* Pin 6 seems to be connected with the oscillator
* Pin 8 is VCCThank you!

DC1MC:
In calling dibs on ATtiny25/45/85  ;D

floobydust:
It is likely a pre-programmed microcontroller. The board's LP xtal is on pins 6,7 which rules out some MCU's, like Microchip 12C508 uses pin2,3 for LP xtal, and it has EEPROM. Also ATtiny uses pin 2,3 as well.
I would check the pinout of DIP-8 MCU's verses the schematic of the transmitter board. I thought ITT did have their own custom silicon. Another similar transmitter is Ademco and maybe DSC; one of which might have bought ITT's security division.

DC1MC:

--- Quote from: floobydust on December 01, 2021, 04:11:56 am ---It is likely a pre-programmed microcontroller. The board's LP xtal is on pins 6,7 which rules out some MCU's, like Microchip 12C508 uses pin2,3 for LP xtal, and it has EEPROM. Also ATtiny uses pin 2,3 as well.
I would check the pinout of DIP-8 MCU's verses the schematic of the transmitter board. I thought ITT did have their own custom silicon. Another similar transmitter is Ademco and maybe DSC; one of which might have bought ITT's security division.

--- End quote ---

There is no ITT here, but ITI (Interlogix), and they will never-ever release anything about their custom IC  :scared:, that I claim (without proof  >:D) that in this particular case can be drop-in replaced with an ATtiny.

elidcoif:
Thanks for your answers. The ATtiny sounds a bit too recent for this sensor, but the pin layout actually checks out. I have a TL8266-based programmer, I may set it to ATtiny and give it a try

Navigation

[0] Message Index

[#] Next page