There was a time when an intercom was simply a pair of boxes with speakers joined by a couple of wires, with an audio amplifier somewhere in the mix. But intercoms have like everything else joined the digital age, so those two wires now carry a load of other functionality as digital signalling. [Aaron Christophel] installs these devices for a living, and has posted a fascinating reverse engineering video that we’ve also placed below the break.
Power for the system is present as a constant 24V DC, and the audio is still an old-fashioned analogue signal that we’ll all be familiar with. On that 24V DC though are imposed a series of pulse trains to trigger the different alarms and other functions, and he describes extracting these with an oscilloscope before showing us the circuitry he’s used to send and receive pulses with an Arduino. The bulk of the video is then devoted to the software on the Arduino, which you can also find in a GitHub repository.
The result is an interesting primer for anyone who fancies a bit of serial detective work, even if they don’t have a intercom to hand.
TL;DW
The basic idea seems to be to encode 1/0 as short/long drop in supply voltage.
quote:
#define startBit 6//ms
#define oneBit 4//ms
#define zeroBit 2//ms
What about 4 wire intercoms? Mine has a power pin for +22V, a 5V “ALARM” pin that cuts on and off, a separate “DATA” pin and a ground. Complicated but with a simple board, probably to make the units cheap. II’ pretty sure that that DATA pin carries both voice and signals.
Oh, and the thing also lacks a microphone at my end (I can just listen not talk), cheapo cheapo…
Sounds interesting!
Do you have brand name?
Anyone hacked the Bticino 2-wire protocol properly? Most ‘hacks’ I see revolve around buying an expensive web gateway.
I have a 2-wire bticino as well. Interested to find if anyone has hacked/decoded it.
This is interesting.
I have a longstanding project to extract video and audio from my Panasonic video intercom to feed into my Synology NAS so I can record whenever the button is pressed.
I found the video appears to be composite video transposed onto the 24V supply, but I haven’t looked deep enough yet to find the audio.
My end goal is to eventually have some sort of adapter that converts to an ethernet jack so it appears on the local network as an IP camera.
I’m thinking about doing a similar thing myself. Did you make any further progress on this?
I have a Centurion PoloPhone (https://www.centsys.co.za/polophone/) which operates in a very similar way, that I would love to be able to extract the audio from! Although I don’t trust the 2-wire bus to pass the “gate open” signals, because the bus is exposed outside the gate at the intercom panel! So I have run a separate trigger wire to open the gate itself.
I would love to have the Polophone send me a notification on Home Assistant via MQTT. Any new findings ?
Great reverse engineering process and investigation.
I wonder if the protocol is “standard” amongst the 2-wire intercoms, or if it is specific for the TCS. I am asking because another very popular brand is the comelit and would like to try with it.
Great reverse engineering process, and great investigation.
I wonder if the protocol you found is a “standard” for the 2-wire intercoms, or if it just works for the TCS. I am asking because I would like to try with another popular brand, the Comelit.
Thanks
TCS uses a propriatary protocoll and interface
I have an Elvox (Vimar) 2 wires plus system in the building, the device also has a direct connection to my wifi network to reach the elvox/vimar server. I can receive intercom calls to my mobile phone but unfortunately I cannot have it on PC, neither (and this I was more interested in) I can have an interaction with external device to activate opening of the gates. Do you have any experience/suggestion about it?
Many thanks