Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Puck]

Thanks again Charles.

I also did some looking into the receiver section of the CM15A since it's schematic was available.
I'm going on the logical assumption here that the DS7000 receiver works the same.

BTW, the bursts of RF modulation method is called Amplitude-Shift-Keying (ASK).

The receiver creates an RSSI signal (Received Signal Strength Index) and compares this to the ambient RF noise it constantly picks up (if any). The changes from the ambient creates the X10 data. The ambient RF reference level is stored in a large capacitor (for a slow gradual change).

If someone were to try and jam the security system with a CW (Continuous Wave), the reference RF level would gradually rise and the receiver would accept it as the new ambient. Therefore, the jamming would only be for a few seconds before the receiver started working normally again. Of course this would not be true if the jamming signal completely saturates the receiver.

Now if someone were to hold down a palm pad button, the ambient RF would still rise but because it too is pulsing on & off, the receiver would still not be able to distinguish the correct sensor signal. But this rise in the ambient RF reference level (which is represented by a DC voltage) gives the possibility to a modification to test for an out-of-the-ordinary rise in the RSSI.

I'm no RF expert by any means (I've always stayed away from this black-magic) and I haven't done any physical tests yet, so if someone else is and sees a flaw in my interpretation and line of thinking for a solution, please join in. 

[Puck]

I looked at the CM15A's receiver and can see a difference in the signal on pin 10 of U1 on the receiver board. This signal is called CPC and is the RSSI signal. (BTW the schematic shows the 20 pin version of the chip but my CM15A had the 18 pin version.)

Watching this pin on a scope I can see a steady DC component (approximately 2.20 volts) when no X10 signal is present. When I transmit an X10 signal, I can see the pulses riding on top of the DC.

To make a steady DC signal which includes the received X10 signals, this line will have to feed an R-C circuit. To prevent causing the CM15A to not operate properly, I made a voltage follower using a 741 op-amp on a small circuit board and installed it inside and ran the output & ground leads to the outside.

As I get a chance I will add the necessary (external) circuit to these leads to create a DC level and see how it changes with a constant X10 signal being transmitted using a palm pad. I will compare this to a normal one time button press and see if the change is enough to make a comparator circuit to detect the jamming signal.

I opened up the DS7000's base and it looks like the receiver is made up of discrete components; so I'm not going near that guy without a schematic. That's why I'm experimenting with the CM15A.

As I do more and find out more, I will post what happens.

[-Bill- (of wgjohns.com)]

... I made a voltage follower using a 741 op-amp ...

Good old 741!  Like the 555 (timer chip), millions of uses and although there may be newer, there are few better!   

[TakeTheActive]

...I looked at the CM15A's receiver and can see a difference in the signal on pin 10 of U1 on the receiver board. This signal is called CPC and is the RSSI signal. (BTW the schematic shows the 20 pin version of the chip but my CM15A had the 18 pin version.)

Watching this pin on a scope I can see a steady DC component (approximately 2.20 volts) when no X10 signal is present. When I transmit an X10 signal, I can see the pulses riding on top of the DC.

To make a steady DC signal which includes the received X10 signals, this line will have to feed an R-C circuit. To prevent causing the CM15A to not operate properly, I made a voltage follower using a 741 op-amp on a small circuit board and installed it inside and ran the output & ground leads to the outside.

As I get a chance I will add the necessary (external) circuit to these leads to create a DC level and see how it changes with a constant X10 signal being transmitted using a palm pad. I will compare this to a normal one time button press and see if the change is enough to make a comparator circuit to detect the jamming signal...

WOW!!! 

I *KNEW*, Right From the Start, That I Was Going to Like Having This New Guy Around.

Please consider contributing your OBVIOUS EXTENSIVE ELECTRONICS KNOWLEDGE to "Community" Member Jeff Volp's thread in:

NEWSGROUP: Comp.Home.Automation  (Read 1522 times)

entitled:

X10 AGC and Insteon

Thanks!

[Puck]

Thanks for the links TTA.

That thread looks like they are looking into ways of improving the PLC reception. I will look at more of the threads there now that I know about it, and contribute anywhere that I can be of help.

[TakeTheActive]

Thanks for the links TTA.

That thread looks like they are looking into ways of improving the PLC reception. I will look at more of the threads there now that I know about it...

More "GOOD STUFF" for you to "...know about..."

• Do modules attenuate X10 line signals like some electronics do?  (Read 2726 times)
  .
• X10 Transmit Booster (XTB)
  

[ArtClark]

I"ve actually read through this thread a few times now and realized an idea from TTA would apply very well here.  It's not the
exact thing mentioned, but an offshoot.  This is what I used for a while while testing a problem, but I suppose you could use
it full time as long as you weren't worred about using a lot of RF commands.  If your alarm system is armed, normally you would
not be controlling a lot at that time anyway.

I took a door/window sensor (Older unit),  added a wall transformer for power, (No batteries, please) and triggered the sensor
with a standard 555 about every minute.  It was simple to have that set a flag.  (I only use OnAlert so not registering this sensor
was not an issue, but if you had an alarm console, I guess that would be...)

Running a timer in the CM15, Clear the flag, wait 1 minute and check.  If flag set, all is OK.  If not (I wait for two fails....)
then you can assume that power failed or the RF is jammed.  (This found two noisy intercoms that I disposed of...)

Very Quick and dirty, an it uses lots of RF commands (which could jam other things if the timing were wrong...) but does
provide an indication that signals are getting through to the CM15.  Just be sure you check twice and more than twice
the time interval from the 555.  (No Sync-up needed that way and provides insurance for timing errors.)

Would this be useable to help in an actual Alarm system or might this be likely tojam other sensors at the exact wrong time,
preventing an alarm and defeating the purpose?  I  have no idea which would be better but it worked for testing...

I must also say "Sorry" because this is a little Off-topic, but I didn't start this thought, so I had to chime in.

[Puck]

I must also say "Sorry" because this is a little Off-topic

Not OT at all; the thread is about understanding how the system can be defeated and how to counter that.

A watchdog timer certainly is a feasible method.
I plan to get back at this this weekend to test the RF generated DC levels... have to do something with the wires I have hanging out of the CM15A. 

[ArtClark]

Please, Puck, keep us updated on this.

Your method would be very effective, and wouldn't tie up transmissions like a watchdog.  Even if the circuit was a little
complex, there are many of us who would find it worth the effort.

Good Luck.   (I think in your case, however, it's more of a matter of skill and experience...)

[x10dispatch]

Tuicemen mentioned this problem might be something i could detect in my program x10dispatcher so i looked into it.

Its sad that the problem exists and this really could use a hardware solution.

However people using my program already are leaving their computers on during the day to monitor their network and i think i have created a workaround.

I added a feature called flood protection which detects Rf remote signal flooding (at least the ones which show up in activity monitor).   I let you adjust the threshold settings but by default i consider around 8 signals within 20 seconds to be flooding.   Since 1 press of an x10 remote actually sends about 3 RF signals (as an insurance policy), the actual settings I made default are 20count/20secs.

It seems to be worthwhile for cm15a flooding but not sure about ds7000 flooding since im not using it, nor security remotes.  If someone is trying to flood your device using a regular x10remote i can detect that and send an email or msn alert.  What i dont know is whether a flooding attempt using a 'security' remote which is not been registered at the base will flood the base unit.

If anyone wants to test out the flood protection then you can download x10dispatcher here :
http://x10dispatcher.com/Downloads.aspx

Once you've got that, download the 366beta here and extract the exe over the original :
http://x10dispatcher.com/Downloads/Dispatch366beta.zip

Dont be intimidated by the many options and tabs but you will need to :
go into the misc tab and enable flood protection (and save settings), and then on the main screen switch to status tab to see when the flooding detection notices appear.... if they do then you could configure a macro to email on them.

I will include this feature in my next setup package but for now its beta (at above link).

Thanks lennymore for letting one more person hijaak your thread    Hope you figured out how to disarm remotely although i think it would require a hardware solution such as the one mentioned here :
http://www.accessha.com/forums/x10dispatch/1292-complete-control-ds7000-security-system-without-voiding-warranty.html

[Puck]

That's awesome x10dispatch.

What i dont know is whether a flooding attempt using a 'security' remote which is not been registered at the base will flood the base unit.

Yes it will... any simultaneous RF in the receiver's bandwidth will result in an invalid / rejected signal interpretation.

I don't know much about the software side of X10, but I'm thinking it will take hardware to detect a non-X10 jamming signal. Would be nice if there is a way. 

Thank's for the software solution. At least that will help with preventing someone from using a cheap X10 remote to jam the system. 

[p2459]

  If someone is trying to flood your device using a regular x10remote i can detect that and send an email or msn alert. 

I'm not sure how email or msn alerts are going to help, unless you are carrying a cell phone
that can somehow receive the alert (assuming its on and has signal strength) I still think you
need the sirens and flashing lights. It is unlikely a thief will stick around long if they know they've
tripped an alarm and a neighbor may be noticing.

X10 Staff seem to be in denial about the fact that the remote does not have to be programmed to
the base to flood it. All whom I've spoken to about the issue insist a remote must first be programmed
to the base to interact with it, but this is simply not true. Tests have proven otherwise.

[x10dispatch]

Yep, alerts are usually email/sms messages to cell phone (preferably a picture message from cam with alert text)... although it would simultaneously instant message you if you were online. 

I think ArtClark's solution (kind of like a cm15a heartbeat sensor) sounds promising but in order to do anything your computer would need to be turned on so it could send an email.   If you are going to leave your computer on you could use x10dispatcher's CM15a armed and disarmed modes in addition to ds7000 armed and disarmed modes.... 

When both are disarmed you can disable his timer via a phantom trigger (or use phantom trigger to set to lower interval like 1-2 mins heatbeat).  Dispatcher disarm via rf button would play disarm wav/notice and launch a macro to sendplc to his phantom trigger.

When you arm dispatcher (using an rf remote  ) it will play arm wav/notice and sendplc to a different phantom trigger which he can use to change the timer to make the heartbeat interval something like 30-60 seconds.

Then you get dispatchers almost 100% guarantee of picking up the x10remote flooding and ArtClarks logic can pick up most security remote flooding attempts without causing too much interference with normal x10 traffic.

Which brings you back to p2459's comment about deterrence.... sending an email wont deter the actual intruder since they wont even know it happened... and you dont have a clear/reliable plc environment to sound a powerhorn, so you would need to use computer to either sound off a warning sound or trigger a horn via usb/serial port somehow.   X10dispatcher includes a utility for setting the computers master volume level so you could crank up the volume and play an alert wav or audio message warning... I have several good enough warning wav files that you could work with.

Not to say this is perfect or even good enough... you should be able to at least work around in hardware... But if your leaving a computer on, then something like the setup above gives you pretty good coverage. 

[Tuicemen]

Hey welcome aboard x10dispatch !
I just got back from a deer hunt so I just had a chance to look at the flooding detection!
Just Awesome! X10Dispatcher just keeps getting better! p2459
If you set a macro so a batch file can be triggered then Topic: Phone Control (AlertDialer) Addon  (Read 3236 times)  could send out a voice alert to any phone number!
You'd need a voice modem for it to work! Can't believe you missed that x10dispatch  
Perhaps once x10 adds the options to the SDK to detect security devices this will be even better

[x10dispatch]

Oops yep... he wants to deter the actual criminals though...

Perhaps you can also write a program to release a deadly canister of toxins to paralyse the intruder or poodle.. 

Good to see you back... hope you had fun.

-Dave