Comcast Xfinity Home

[skandragon]

This is more for information than an issue. I'm trying to use the alarm's telemetry to hook into OpenHAB, so I can use existing door sensors rather than having to install a parallel set for home automation.

Xfinity seems to have some device that sits between the Vista 20P and the otherwise normal seeming LCD keypad. I believe it may be intercepting things from the physical keypad, and pretending to also be a keypad to the Vista. It may also pretend to be devices, since I think at least a few sensors communicate things like temperature, serial number, and battery level through to the iPhone app.

I also have a wireless module connected to the Vista, which seems to be pulling telemetry from the older, existing wired devices.

If I sniff the receive line, I get things like this pretty much constantly, although the display panel shows nothing other than "ready to arm":

00:   02 00 01 10 12 00 00 08    02 00 00 46 41 55 4c 54    ...........FAULT
10:   20 31 32 20 20 20 20 20    20 20 20 20 20 20 20 20     12             
20:   20 20 20 20 20 20 20 20    20 20 20 db 00                        ..   
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
F7 message, length (fixed) 45
00:   02 00 01 10 11 00 00 08    02 00 00 46 41 55 4c 54    ...........FAULT
10:   20 31 31 20 20 20 20 20    20 20 20 20 20 20 20 20     11             
20:   20 20 20 20 20 20 20 20    20 20 20 dd 00                        ..   

This is using my own code which currently just hex dumps a "known" message, and prints the hex value for any bytes that seem like filler (hence the strings of 00 bytes)

I also periodically get various lengths of F2 messages, but I also get 9E:

00:   02 25 f1 ed                                           .%..            
00:   02 20 81 62                                           . .b            
00:   02 25 60 7e                                           .%`~
00:   02 20 81 62                                           . .b            
00:   02 25 82 5c                                           .%.\            

These look too regular to not be data of some sort.

[skandragon]

I ended up plugging into the receive side for the controller, so I can tap into my 58xx RF receiver. So far, that's more interesting. :)

[markkimsal]

The fault codes happen a lot of the time. If a door is open or a motion sensor is activated the system puts out faults. If the system is unarmed then nothing happens, you just can't arm it. If the system is armed then a fault turns into an alarm. The fault is the opposite of the "ready-to-arm" light on the keypad.

It's strange that you say you're seeing both fault codes and the ready-to-arm light at the same time. If you hit * on the keypad does it cycle through a list of faulted zones?

I'm not sure what the short F2 messages are for, I just ignore them. Anything less than 18 bytes doesn't seem to have anything important. It could be meant for things that aren't keypads, like phone dialers and wireless add-ons.

Thanks for the input.

[skandragon]

Comcast has what is in effect a takeover device that sits between the alarm panel and the user-touchable keypad. This takeover device appears to be a keypad itself to the alarm panel. One set of wires goes to the panel, one to the user-visible keypad.

I believe this device speaks zigbee or some other protocol to the Comcast touch screen, which appears to be the heart of the Comcast alarm offering. It either only maps specific sensors on the taken-over system to the touchscreen, or sends them all and the touch-screen decides what is important. Also, this takeover appears to receive information on what to display from the touch-screen, and displays this on the user-visible keypad. So, what the user sees is far removed from actual alarm activity.

It does seem to pass along things like low batteries, tamper, and both contacts of the sensors I have, but only the programmed-in contact is used: either the wired one, magnetic reed, etc.