Any details on how Wi-Box talks to the VDS telephone? about wibox

[duhow]

Hi! I'm not investigating on hardware level, but instead trying to reuse the same board and part of the software to recreate the same functionality (and a bit of reverse engineering).

Intercom phones are simple boards, no CPU nor Linux, at least that's what I can tell from my Fermax Loft VDS.

What I can tell from the Wibox board components, I think there are too many hardware chips and it's kind of surprising they're working like this, instead of computing them.

Some of the chips used are:

Nuvoton N76E003AT20
Nexperia HEF4093BT
XMC 0H128AHIG
Bitek BIT1628A
UTC MC34118G

Here the most interesting one is the UTC MC34118G, which is the "voice switched speaker-phone circuit".

Since this is a digital intercom (VDS) and not analog, it is not as simple as just adding a relay to unlock the door, but maybe adding more components may enable the ESP32 and be enough for the purpose of opening the door and detecting the call.

On the other hand, there is Fermax Nearkey, which is an ESP32 connected in the street intercom, having the door relay next to it makes sense that it works with a simple relay instead of sending the digital pulses.

[teixeluis]

@duhow thanks for the feedback. It is curious why the existence of the Bitek BIT1628A, which is an analog video ADC chip. I was expecting these boxes to interface with a digital video stream from the speakerphone.

[danijelt]

I started investigating this myself. However, without Wi-Box, just a spare plain telephone, model 3390. I've tapped into the data line (L) and captured the data exchanged between outdoor and indoor units. The hex codes documented in this repository don't correspond to what appears on VDS data bus. I guess that is some internal communication where some other part of the system picks it up and translates into VDS commands.

This is just some preliminary info (and some of it is guesswork), but it works like this:

• parameters are 1200-8-O-1: 1200 baud, 8 data bits, odd parity, one stop bit
• units communicate with 2-byte packets: first byte is the command, second byte is intercom ID (corresponds to the number dialed on the outdoor unit)
• intercom rings when it receives either 0x59 + 0xID or 0xA9 + 0xID (probably primary/secondary outdoor panel, a.k.a. channels)
• outdoor unit will send both 0x59 + ID and 0xA9 + ID when dialing inside, with inactive channel's ID set to 0xF0 - this is probably to interrupt all active calls that might be in progress on another panel
• hanging up after the call will also send ID 0xF0
• sending the captured unlock command (0x2B + ID for secondary panel) won't open the door if the ID is not dialed from the panel

There's still work to be done. My system appears to be configured with a single outdoor panel set to secondary mode, based on the commands order. I also can't initiate audio and/or video from the indoor unit (I also have Smile monitor inside). I still have to find a convenient time to dismantle the outdoor panel and check the jumpers :)

@teixeluis Audio and video are analog. Audio is sent over data bus (L), together with serial data (that's why there's a short interruption of audio when pressing the door button) and video is on separate wires. That's why you see that ADC chip.

[ManuelJimenezBuendia]

I started investigating this myself. However, without Wi-Box, just a spare plain telephone, model 3390. I've tapped into the data line (L) and captured the data exchanged between outdoor and indoor units. The hex codes documented in this repository don't correspond to what appears on VDS data bus. I guess that is some internal communication where some other part of the system picks it up and translates into VDS commands.

This is just some preliminary info (and some of it is guesswork), but it works like this:

• parameters are 1200-8-O-1: 1200 baud, 8 data bits, odd parity, one stop bit
• units communicate with 2-byte packets: first byte is the command, second byte is intercom ID (corresponds to the number dialed on the outdoor unit)
• intercom rings when it receives either 0x59 + 0xID or 0xA9 + 0xID (probably primary/secondary outdoor panel, a.k.a. channels)
• outdoor unit will send both 0x59 + ID and 0xA9 + ID when dialing inside, with inactive channel's ID set to 0xF0 - this is probably to interrupt all active calls that might be in progress on another panel
• hanging up after the call will also send ID 0xF0
• sending the captured unlock command (0x2B + ID for secondary panel) won't open the door if the ID is not dialed from the panel

There's still work to be done. My system appears to be configured with a single outdoor panel set to secondary mode, based on the commands order. I also can't initiate audio and/or video from the indoor unit (I also have Smile monitor inside). I still have to find a convenient time to dismantle the outdoor panel and check the jumpers :)

@teixeluis Audio and video are analog. Audio is sent over data bus (L), together with serial data (that's why there's a short interruption of audio when pressing the door button) and video is on separate wires. That's why you see that ADC chip.

Hi @danijelt. I would be very grateful if you could give me details on how to tap the data line of the VDS. Is it an RS-485 bus or just an RS-232 serial communication? I would like to program an ESP32 to automate the intercomm and integrate it in Home Assistant.

[danijelt]

@ManuelJimenezBuendia It's RS232 with parameters given above. I use an old Fermax 3390 PCB as the interface:

• 5V RX can be connected to J12 on one of the outputs of HEF4093 in the bottom left of the board
• 5V TX can be connected to R2 on the gate of the MOSFET in the top right - the line leading from the IC must be cut

Keep in mind that you need to invert TX if you take this approach. I've connected it to an ESP8266 board via level shifter and it works fine.

[ManuelJimenezBuendia]

@ManuelJimenezBuendia It's RS232 with parameters given above. I use an old Fermax 3390 PCB as the interface:

• 5V RX can be connected to J12 on one of the outputs of HEF4093 in the bottom left of the board
• 5V TX can be connected to R2 on the gate of the MOSFET in the top right - the line leading from the IC must be cut

Keep in mind that you need to invert TX if you take this approach. I've connected it to an ESP8266 board via level shifter and it works fine.

Thanks a lot. I will check it on my board.