Firmware flash – success!

After having some very useful discussions with a few people (special thanks to ComTexeStarter) I came to the conclusion that there was nothing fundamentally wrong with my initial approach – ie using the FTDI board – and that the reason it hadn’t worked was down to software problems.

So I tried again today, the main difference being I was using a new laptop with a clean install of Windows 10. The driver for the serial port was automatically installed, and the Texecom firmware flasher picked it up as a ‘USB-COM’ cable as before. I took a deep breath, pressed ‘Flash’ and…

IMG_20160319_173540 - Copy

Success! Everything worked perfectly and the process was complete in about 3 minutes. Following this (as per the manual) I factory reset the panel by removing all power and then powering on whilst holding down the ‘Reset defaults’ button on the main panel PCB.

This caused a bit of a racket with the tamper alarms going off and you then have to enter the default code (1234). Once it settled down, I used Wintex to restore a backup of the configuration data taken a few days ago and the panel is back to normal. You also need to change the firmware version in the configuration screen so that it resets all the new settings to sensible defaults. If you don’t do this you can get some odd behaviour.

ComTexeStarter has been doing some great work on understanding what the programmer PCB does – and the answer seems to be, ‘not much’. Here is my (rather blurry) photo with their annotations (NB this is the correct version, I had previously posted an earlier one with different resistor numbering):

1000-HDC-back

Most of the components and the chip seem to be concerned with feeding 12V to JP2 pin 1 which we think is used to power one of the older Texecom (non-USB) serial interfaces and so is redundant for the USB ones. This means that it should be possible to do the firmware flash with just the UART plus a few resistors to set the panel to programming mode.

ComTexeStarter has worked hard on this and has come up with this schematic which separates off the chip and the 12V supply (in the red box) from what is actually needed to do the programming:

1000-HDC-schematic

Given that this is now a reverse engineered CDH-0001 this has been christened the 1000-HDC!

It’s quite obvious that Texecom have been churning these out for years (certainly since 2005 – date on the board) at a time when USB cables were rare or unavailable. They could almost certainly redesign their panel PCBs to support programming just from a USB cable which would be a lot cheaper and easier. Maybe they will do so in future.

The other thing I did whilst I had the panel open was install one of the new ComPort+ boards into the header pin sockets.

IMG_20160319_172615

You can see it just under mains supply cable, plugged into the header with the (old) firmware version of LS1 v.211.09 on it. It is dead simple in construction:

IMG_20160319_211137

At a quick glance the pin assignments appear to be (reading the pins from left to right when the board is installed – so pin 1 would be rightmost pin on the above picture:

Pin 1 – NC
Pin 2 – 12V
Pin 3 – GND
Pin 4 – NC
Pin 5 – NC
Pin 6 – NC
Pin 7 – NC
Pin 8 – NC
Pin 9 – RXD
Pin 10 – TXD

So if you don’t want to pay £7 for 5 of these boards (like I did!) and you want an additional serial port, I think you could just connect up your UART to pins 3, 9 and 10 directly. There are a couple of other components – the three pin SMD device is marked Z2X and is I think a Zener diode which is connected between to RXD, and has one leg grounded and the other not connected. The same track feeds goes to an SMD resistor (47k) and then to the 12V line. I don’t really know enough electronics to understand why this might be. However given the RXD pin appears isolated from 12V and connects directly to the header I suspect you could connect directly up to them without a problem. I’d be interested to hear if anyone tries it… meanwhile I have 4 more of these boards to get rid of so let me know if you’d be interested in one.

I haven’t tested Com3 yet but I have another UART on order to test it.

Exciting times!

Advertisements

23 thoughts on “Firmware flash – success!”

  1. The zener and resistor set a defined high level for the rx pin so it is not floating; a floating pin could cause odd behaviour on the rx pin of the microcontroller. The tx won’t need this from the panels point of view since the panel controls the tx pin itself. Through the resistor the high level voltage is supplied, however due to the high resistance only a small current can go through. The zener lowers the 12 volt to the desired voltage. Due to the resistor the current the zener needs to handle is limited so it won’t blow.. and additionally such a low current will not influence the 12 volt supply..
    If a real device is connected it will be able to overrule the high level when it needs to because it can drain more current to set the level low then the resistor can deliver to make it high..
    That should about sum up the workings i think.. hope its understandable 🙂 correct me if im wrong its still early in the morning for me..

  2. Thanks for that – makes sense. I wonder why they felt the need to put this on the extra board, as I suppose the pins on the existing connector would be just as likely to float. I imagine that it would work fine if you did connect a UART directly to the pins without using the breakout board, I’d be interested to hear if anyone has tried this.

  3. they probably put it on there in case the device that is connected to the com port only receives data and doesn’t have a tx it will not act up… (for example the x10 protocol is only one way – data is send to devices but nothing is send back.. theoretically it could be that the x10 com device only connects the tx line..)

    im thinking of updating my premier 88 to an elite 48 to allow full comip, comgsm and connection to home automation system ( premier 88 has only 2 com ports)

    I have two questions on the new firmware 3.01… hopefully you can help me!
    – The android app is supposed to be more secure due to the key generated in the android app that also has to be entered in the panel. Do you happen to know if you need engineer access to do this or can you do this as a normal user ?
    – Through the android app you can control outputs, the pc control outputs if i understand correctly. How many pc control outputs does the elite 48 have available in the android app when basic arming is active ? .. can’t find it in the specs.. (older 48 version had only 4 and this was explicitly noted in the instructions)

    Thanks in advance !

  4. I think the upgrade to an Elite panel is definitely worth it as it does allow you to do a lot more.

    To answer your questions:

    I’m pretty sure that you do need engineer mode in order to get the key. In fact it seems that you need engineer mode to do most things, as far as I can see the actual user is fairly limited in what they can do. However there may be some more options for users that I’m not aware of.

    I’ve not actually tried the Android app myself as yet, as I’ve been using SMS for remote control. However, on the 48 board there are 2 programmable outputs, and a further 8 ‘digicom’ outputs. You can program any of these to a whole loads of different events using Wintex. In software there are still 4 ‘PC control’ outputs which you can assign from Wintex but I am not quite sure whether these are controllable from the app.

    I need to have a closer look at the app so that I can get to grips with how it works.

  5. Extra treaser for the Elite serie, there is real time small talk for all events on the serial (domotics) output; user events, zone events, dis-/arm etc.

    For the Android app; you generate a unique key (with the app) that needs to be add in the control panel.
    Personally got no good experience with the app; comm-ip locks up very often (needs a soft reset – engineer menu). Maybe I am expecting to much or test/play to much with it (guess so…)

  6. Thanks for the infos ! I assume the serial output you mention only provides information…no way to arm,disarm etc? I guess i will try the pi solution as a test and see hiw stable that is..but first i need the flash tool

  7. I think that you can send commands as well, and I’ve been using a plugin which was developed by someone for the Vera controllers which does just this. The protocol is under NDA with Texecom but I know several people have signed up and have been able to work on it. So with a bit of experimenting and watching the serial ports it might be possible reverse engineer something.

  8. Sure you can send commands!
    Don’t know anything about a reserved engineer 😉

  9. Hi, do you still have spare ComPort+ boards? Found your articles very helpful … will be making some cables soon 🙂

  10. Hi, happy to take a com port+ board off you if you have some left, and pay for sending it, found your articles very interesting, Chris

  11. I’d also be interested in a serial header if you still have any – I’m intending to integrate my panel into my home automation system and your site has been very useful so far. Now I just need to get my head around the serial protocol as I think I can use my alarm detectors to show which rooms in the house are occupied for heating and lighting control. Assuming I can use all 3 serial ports independently that is (for DIY COM-IP (link to Wintex on my laptop), DIY COM-GSM (SMS alerts) and the link to my HA server).

  12. Sorry, I don’t have any left now – however as per an earlier post I think that you could connect directly up the relevant pins without too much trouble. You certainly can use all three ports independently, so that shouldn’t be a problem. I have already played with some third party plugins which make use of the protocols for feeding data from the sensors and they work well. I hear from sources that the upcoming v4 firmware has improvements in this area. Also I think that Texecom are helpful to developers and are willing to share details of their interface if you sign an NDA. I’ve not done this myself but I know of others that have.

  13. Thanks for your reply – after posting I’d read a few more of your posts and realised from the comments that you would already have depleted your stash…
    I had a read of the posts about the serial header and came to the same conclusion regarding just hooking it up. It’ll be connected to a ‘proper’ bi-directional serial port so I don’t think I’ll need any of the resistors as (I assume) my SoC PC will already be doing the pull-ups.
    I only found out about the v4 stuff from your blog too – and now I think I’ll put things on hold with writing my plugin to see what the future holds instead. I already have the serial protocol data under NDA from Texecom (but no panel as yet) but it seems a waste of effort to develop for v3 when v4 is around the corner and promises more!
    Keep up the good work 🙂

  14. Thanks

    I’m getting a bit impatient now as it’s been a while since the announcement of v4 but nothing released yet. I’ve heard from a few people who’ve had a preview and it seems there is a lot of good stuff in it. I am still very keen on the idea of integration although I’ve still not really settled on a main system for house control. I still have a Vera at the moment but would rather something open, although finding a system which is under active development and looks good is still a bit tricky.

    I’d be very interested to hear how you get on… watch this space for v4 news!

  15. My plan was to integrate everything into OpenHAB as it appears to support most things I want to use and is supposedly very easy to write plugins for. I have installed it but haven’t even tried to go any further yet, so it may be a bit ambitious to write a full plugin as my first use! I don’t want to buy a Vera though as they don’t appear ‘advanced’ enough for what I want – it’s users like yourself that have outgrown them that convinced me not to waste time and money going that route, and I haven’t seen anything else that has Texecom integration out of the box. I figured if I have to write a plugin then I might as well pick a system that already supports everything else I want to use (Onewire, modbus, zwave, serial, etc).

  16. I love your Texecom posts.Happy to know there are more guys like me out there love playing around with there panels.What is the GSM modem you hooked up on to the panel? It doesn’t look like the original ComGSM 🙂 Do you use it for UDL via Wintex or just triggering SMS notifications thought the Texecom outputs? I am pretty sure you won’t be able to use it for UDL with normal PayAsYouGo SIM.Will be interested to know.Cheers

  17. Thanks! I’ve really enjoyed my adventures so far and I’m glad you have too. I am using a cheap chinese board instead of a ComGSM, as you say nothing like the original one in appearance or price. I think I paid no more than £10 for my board. The details are in an older post here: https://gw0udm.wordpress.com/2015/11/12/dead-end-but-not-all-bad-news/. I found out with a bit of digging that the main panel issues bog-standard AT commands and at least in theory any GSM modem could be make to work. I was pleased because I could fit it all inside the metal box and mounted the antenna on the top. I’ve not tried using UDL, I am using it for SMS mainly. However I don’t see why it wouldn’t work – unlike the ComIP the DIY solution is an exact copy of the real one so I think it will work. I will have to give it a try.

  18. Can any of you chaps with the adaptor board confirm that the pull up is 47k (Marked 473) and what the marking is on the zenner? I am assuming that it is a 4V7 or 5V1 zenner and I want the circuit I’m making to be identical to the OEM Texecom one.

  19. I’m sure that it is a 47k pull up, and the Zener is marked Z2X. It’s difficult to find direct reference to the detail of this, although there is some more info here that might be helpful:

    http://www.s-manuals.com/smd/z2

    Please report back what you find, I’m not sure that either the pull up or the zener are essential to make it work but as you say it would be good to have it as close to stock as possible!

  20. Thanks for that. Looks like a 5.1V zenner to me which makes sense. As mentioned above, there probably isn’t a pull up on this pin on the main board which is bad from a noise immunity point of view. As a 5V rail wasn’t available to pull to they have pulled to 12V and then used the zenner to limit the voltage on the pin. Thanks for the quick response!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s