Chuango Alarm Hack

1,435

4

7

Intro: Chuango Alarm Hack

I have an Chuango G5 alarm in my house. Here in Denmark it is normally sold as a "Sikkert hjem" alarm (https://www.sikkerthjem.dk/villapakken-alarmsystem...). It is reasonably priced and basically works quite well, e.g. it provides a remote control app for smartphones. But there are still a few things I am missing from the standard package, which I think would also apply to a lot of other security systems out there:

  1. The main unit of a security system should be mounted away from the entrance. Otherwise a burglar could smash it before it manages to send its alert message
  2. It should be possible to integrate an alarm system with other home automation applications. Especially the status of the system should be available on the LAN.

Regarding #1: with the alarm panel not being visible, you need another way to make the alarm status visible at the entrance.

Regarding #2: if you can somehow read the status of your alarm system, it is fairly easy to make it available on your LAN using an Arduino and an Ethernet shield.

Step 1: Identify the Three Status LED on the Front Panel

In the bottom of the front panel, 3 LEDs are used to signal the current state of the Alarm. With the alarm panel mounted away from the entrance, these status indicators must be read somehow and displayed near the entrance.

Notice: whenever you mess about with this alarm, you should keep your key-chain remote control at hand. You are bound to trigger the tamper alarm or zone alarms multiple times...

Initially I did not want to break the alarm open, and therefore I used photo resistors to read the three status LEDs, but over time that did not work so well, so eventually I decided to open the box and solder wires.

The front panel is glued to the back part with double sided adhesive tape. Forcing the front and back apart is done much like you would open a smart phone or a tablet. Since I do not have any specialised tools for this, I ended up using a handful of guitar picks I had laying around.

The state of the three status LEDs are available on pin 4, 5 and 6 of U2. Solder wires to those pins and provide a small connector, like e.g. one for 3 pin headers.

Step 2: Identify the Input Signals and the Alarm Signal

Since the alarm box has now been opened, why not get access to as much as possible? I decided to bring a much a possible out on a DB9 connector.

In the middle of the back part PCB there are 5 holes. I routed cables through these holes and connected them to the screw terminals on the back side. The wires routed to the DB9 connector are:

  1. GND : black wire - attached to screw terminals on the back

  2. Speaker/alarm detection : brown wire - attached to screw terminals on the back. Whenever an alarm is triggered this signal will be assert to around 10V (!!!)

  3. 5V : red wire - soldered to the PCB (this ended up not being used for anything)

  4. Alarm armed : orange - attached to the pin header soldered on the front panel

  5. Shell armed : yellow - attached to the pin header soldered on the front panel

  6. Alarm disabled : green - attached to the pin header soldered on the front panel

  7. Zone1 : blue - attached to screw terminals on the back

  8. Zone2 : purple - attached to screw terminals on the back

  9. Open door : grey - attached to screw terminals on the back

Step 3: Schematics

The colours of the wires in the "breadboard view" are matching the description from the previous step.

Step 4: Test on Breadboard

An 'ENC28J60 Ethernet Shield' is used to provide Ethernet connection (not shown in the previous schematics).

As library for the Ethernet shield both of these are usable:

I am currently using the later (UIPEtherner), as there seems to be more recent activities on that library.

The main software can be found here:

Step 5: Making a Repeater for the Status Indicators

My back entrance door has a glass window through which I can see this 'repeater box'. The box is simply equipped with three LEDs that are routed through a cable to the electronics circuitry that will be described later.

  • Red LED: the entire system is armed
  • Yellow LED: only the shell/door protection is active (not the PIR sensors inside the rooms)
  • Green LED: the system is disabled

Step 6: Mount on PCB

Once everything is working, move the components from the bread board onto a prototype PCB.

Notice the BC547 transistor. Most signals inside the alarm are TTL, but the signal driving the speaker is around 10V. Signals at that level are likely to fry your Arduino. Luckily mine only did reset, until I realised that the signal level was so high. After mounting the transistor things are fine.

Step 7: Fit Into Enclosure

When the soldering work is done, the construction is placed into an enclosure.

The main problem here being the number of wires going to the device:

  • DB9 cable providing the connections to the alarm
  • Mini USB cable providing power and allowing software modifications
  • Ethernet cable
  • Cable going to the external speaker

I ended using a small food container as enclosure. There is a little heat dissipated, so keep this in mind when selecting enclosure. The food container has worked well for 1½ year now.

An external speaker is optional, but I had one laying around anyway. Just be warned again: you are bound to trigger alarms when you mess around with this alarm, and the external speaker is very loud, so keep the remote control at hand.

Step 8: Finally...

Mount everything in a suitable location.

My stuff ended up in a kitchen cupboard along side a wireless switch. Not very pretty, but also not very visible...

Future improvements:

  • Glue the alarm front panel back into place. It is still after 1½ year held in place by rubber bands...
  • Make a nicer enclosure for the Arduino and a nicer installation in the cupboard.
  • Integrate the alarm with my 'ZoneMinder' video surveillance system (send additional motion notifications when the alarm system is active)
  • Ensure that alarms are also send out on the Internet (not just SMS)

Share

    Recommendations

    • Fix It! Contest

      Fix It! Contest
    • Tiny Home Contest

      Tiny Home Contest
    • Furniture Contest 2018

      Furniture Contest 2018

    7 Discussions

    0
    None
    hansoggerte

    Question 2 months ago on Step 8

    Hey Lars, thanks for sharing, one question, i have the same alarm system as yours, but with a lot more accessories (aprox 20) and was thinking if your DB9 could read/write to the system and not only the first 9 accessories but all.

    and at the bottom you wrote that there will be updates. :) any process ?

    1 more answer
    0
    None
    LarsWHhansoggerte

    Answer 2 months ago

    My PCB version is not the same as Edgar62 has. I did not locate any serial port my PCB. I am not doing any detection of devices - just the main state. I do not expect to do more work on this alarm.

    0
    None
    edgars62

    Question 6 months ago

    it would be possible to make the improvements by receiving these messages through the serial port and send it to the internet here, for example, when an area is activated:

    RF data parse ...

    -> Detector ...

    rfData.DetIndex: 3

    Zone = 2

    These are when you go pressing the number keys are saved in ioData.Buffer key eject "9":

    Key value = 0x0040

    Key = 9

    ioData.Kcnt = 6, ioData.Buffer: 707289

    LED ...

    ledData.Led0: 0x0

    ledData.Led1: 0x12

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED

    Beep: 1 ...

    Beep: 1.

    These are the messages of the alarm, that is to say, going from off to on:

    VERSION: G5_Plus_V1.0_20170111_21Language_EN

    -> proc_subtask1 (ALARM) entry ...

    ALARM proc.

    CALL proc.

    -> proc_subtask3 (IO) entry ...

    -> proc_subtask4 (RF / RFID) entry ...

    -> proc_subtask5 (SMS) entry ...

    SMS data parse.

    -> proc_subtask6 (TIME) entry ...

    TIME proc.

    -> UART2 Write ...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    FOTA proc.

    << RIL is ready. >>

    AT + QECCNUM = 3,1, "02", "17", "000", "100", "110", "111", "112", "113", "190", "911", "999 ", ret = 0

    AT + QECCPGM = 1, ret = 0

    -> UART2 Write ...

    Length = 8, Data: AA040052

    -> UART2 Write.

    << Received URC type: 3 >>

    << GSM Network Status: 2 >>

    << Not registered, but module is currently searching for a new operator. >>

    << Received URC type: 4 >>

    << GPRS Network Status: 0 >>

    << Not registered, module not currently search a new operator. >>

    -> UART2 Write ...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    << Received URC type: 5 >>

    << CFUN Status: 1 >>

    << Full functionality. >>

    << Received URC type: 2 >>

    << SIM Card Status: 1 >>

    << SIM card is ready. >>

    << Received URC type: 4 >>

    << GPRS Network Status: 2 >>

    << Not registered, but module is currently searching for a new operator. >>

    << Received URC type: 1 >>

    << Sys Init Status 2 >>

    << Call is ready. >>

    << Received URC type: 1 >>

    << Sys Init Status 3 >>

    << SMS is ready. >>

    << Received URC type: 3 >>

    << GSM Network Status: 1 >>

    << Module has registered to GSM home network. >>

    << GSM is ready. >>

    << Received URC type: 4 >>

    << GPRS Network Status: 1 >>

    << Module has registered to GPRS home network. >>

    2 more answers
    0
    None
    hansoggerteedgars62

    Answer 2 months ago

    Hey Edgars62, did you manage to add a db9 connector and read the Communications send from and to the unit?

    0
    None
    LarsWHedgars62

    Answer 6 months ago

    Nice, but I do not believe my alarm has any serial port. Can you provide some guidance?

    0
    None
    edgars62

    Question 6 months ago

    It's a bit hard to see where the rx and gnd tx ports are

    1521498075721196748019.jpg
    0
    None
    edgars62

    Question 6 months ago on Step 8

    saludos estimado

    me preguntaba se podria hacer configuracion mediante comunicacion serie tx rx logre sacar algunos mensajes de la alarma pero no se que comandos mandar para configurar:

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    << Received URC type: 8 >>

    << New SMS Arrives: index = 2 >>

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    < Register callback for ADC >

    < Initialize ADC (Sampling count = 5, Sampling interval = 200ms) >

    < Start ADC sampling... >

    IO Initialize...

    IO Initialize.

    SMS Initialize...

    sysSetup.DelayTime = 0

    sysSetup.SingleDelayTime = 30

    sysSetup.Language = 4

    sysSetup.Memo = 0

    sysSetup.MemoTime = 24

    sysSetup.RecTime = 0

    sysSetup.Status = 0

    sysSetup.SirenTime = 5

    sysSetup.SirenVolume = 2

    sysSetup.KeyTone = 1

    sysSetup.WirelessSirenTone = 0

    sysSetup.Tamper = 1

    sysSetup.ReportSetups = 0

    sysSetup.SmsAlerts = 0

    sysSetup.MsgRef = 1

    sysSetup.Interference = 0

    sysSetup.Password = 1234

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    SMS Initialize.

    apnName: [cmnet]

    apnUserName: [""]

    apnPassword: [""]

    apnBuffer->

    apnname:cmnet

    apnusername:

    apnuserpwd:

    ftpBuffer: www.cgftpserver.com

    Siren OFF.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    VERSION: G5_Plus_V1.0_20170111_21Language_EN

    -> proc_subtask1(ALARM) entry...

    ALARM proc.

    CALL proc.

    -> proc_subtask3(IO) entry...

    -> proc_subtask4(RF/RFID) entry...

    -> proc_subtask5(SMS) entry...

    SMS data parse.

    -> proc_subtask6(TIME) entry...

    TIME proc.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    FOTA proc.

    << RIL is ready. >>

    AT+QECCNUM=3,1,"02","17","000","100","110","111","112","113","190","911","999", ret = 0

    AT+QECCPGM=1, ret = 0

    -> UART2 Write...

    Length = 8, Data: AA040052

    -> UART2 Write.

    << Received URC type: 3 >>

    << GSM Network Status: 2 >>

    << Not registered, but module is currently searching a new operator. >>

    << Received URC type: 4 >>

    << GPRS Network Status: 0 >>

    << Not registered, module not currently search a new operator. >>

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    << Received URC type: 5 >>

    << CFUN Status: 1 >>

    << Full functionality. >>

    << Received URC type: 2 >>

    << SIM Card Status: 1 >>

    << SIM card is ready. >>

    << Received URC type: 4 >>

    << GPRS Network Status: 2 >>

    << Not registered, but module is currently searching a new operator. >>

    << Received URC type: 1 >>

    << Sys Init Status 2 >>

    << Call is ready. >>

    << Received URC type: 1 >>

    << Sys Init Status 3 >>

    << SMS is ready. >>

    << Received URC type: 3 >>

    << GSM Network Status: 1 >>

    << Module has registered to GSM home network. >>

    << GSM is ready. >>

    << Received URC type: 4 >>

    << GPRS Network Status: 1 >>

    << Module has registered to GPRS home network. >>

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: 6A3B1B

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 3

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: E64935

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 1

    UART proc...

    UART proc...

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: E64935

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 1

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: 6A3B1B

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 3

    UART proc...

    RF: 6A3B1B

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 3

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: E611FD

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 2

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    UART proc...

    UART proc...

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: 87E310

    RF data parse...

    -> Remote...

    rfData.RemIndex: 4

    Zone = 2

    -> Remote DISARM

    Siren OFF.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x3

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 2...

    Beep: 2.

    Wireless Siren: 3...

    -> UART2 Write...

    Length = 8, Data: AA040052

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA060010030000003D

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030251

    -> UART2 Write.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    UART proc...

    RF: 27F804

    UART proc...

    RF: 87F804

    UART proc...

    RF: 87E310

    RF data parse...

    -> Remote...

    rfData.RemIndex: 4

    Zone = 2

    -> Remote DISARM

    Siren OFF.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x3

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 2...

    Beep: 2.

    Wireless Siren: 3...

    -> UART2 Write...

    Length = 8, Data: AA040052

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA060010030000003D

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030251

    -> UART2 Write.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    UART proc...

    RF: 27F804

    UART proc...

    RF: 87F804

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: 6A3B1B

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 3

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: 6A3B1B

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 3

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    Key value = 0x0100

    Key = 7

    ioData.Kcnt = 1, ioData.Buffer: 7

    LED...

    ledData.Led0: 0x80

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA06801000000000C0

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0010

    Key = 0

    ioData.Kcnt = 2, ioData.Buffer: 70

    LED...

    ledData.Led0: 0x1

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA060110000000003F

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0100

    Key = 7

    ioData.Kcnt = 3, ioData.Buffer: 707

    LED...

    ledData.Led0: 0x80

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA06801000000000C0

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x2000

    Key = 2

    ioData.Kcnt = 4, ioData.Buffer: 7072

    LED...

    ledData.Led0: 0x4

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA060410000000003C

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0080

    Key = 8

    ioData.Kcnt = 5, ioData.Buffer: 70728

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x11

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA060011000000003F

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0040

    Key = 9

    ioData.Kcnt = 6, ioData.Buffer: 707289

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x12

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA060012000000003E

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x1000

    Key = 1

    ioData.Kcnt = 7, ioData.Buffer: 7072891

    LED...

    ledData.Led0: 0x2

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA060210000000003E

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0400

    Key = 6

    ioData.Kcnt = 8, ioData.Buffer: 70728916

    LED...

    ledData.Led0: 0x40

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Beep: 1...

    Beep: 1.

    -> UART2 Write...

    Length = 18, Data: AA0640100000000000

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0008

    Key = F

    ioData.Kcnt = 9, ioData.Buffer: 70728916F

    Beep: 1...

    Beep: 1.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x18

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x80

    ledData.Flash2: 0x0

    LED.

    Work states: WORK

    CALL proc...

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x18

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x80

    ledData.Flash2: 0x0

    LED.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA06001800008000B8

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA020153

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA06001800008000B8

    -> UART2 Write.

    < Dial... >

    telBuffer: 70728916

    < Dial. ret = 0, callstate = 0 >

    Key value = 0x0008

    Key = F

    ioData.Kcnt = 1, ioData.Buffer: F

    Beep: 1...

    Beep: 1.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x18

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x80

    ledData.Flash2: 0x0

    LED.

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    -> UART2 Write...

    Length = 18, Data: AA06001800008000B8

    -> UART2 Write.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Work states: IDIL

    CALL proc.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    -> UART2 Write...

    Length = 8, Data: AA020054

    -> UART2 Write.

    UART proc...

    RF: E611FD

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 2

    -> Key end.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    UART proc...

    RF: E611FD

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 2

    UART proc...

    RF: E611FD

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 2

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    UART proc...

    UART proc...

    UART proc...

    RF: E611FD

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 2

    UART proc...

    -> Ack

    -> UART2 Write...

    Length = 6, Data: AA81D5

    -> UART2 Write.

    UART proc...

    RF: E611FD

    RF data parse...

    -> Detector...

    rfData.DetIndex: 3

    Zone = 2

    UART proc...

    Key value = 0x0020

    Key = E

    ioData.Kcnt = 1, ioData.Buffer: E

    Beep: 1...

    Beep: 1.

    LED...

    ledData.Led0: 0x0

    ledData.Led1: 0x10

    ledData.Led2: 0x0

    ledData.Flash0: 0x0

    ledData.Flash1: 0x0

    ledData.Flash2: 0x0

    LED.

    Key value = 0x0020

    Key = E

    -> UART2 Write...

    Length = 8, Data: AA030152

    -> UART2 Write.

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    -> UART2 Write...

    Length = 18, Data: AA0600100000000040

    -> UART2 Write.

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0020

    Key = E

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =

    Key value = 0x0840

    Key =