I'm plan to interface a atmel avr with my alarm system in home but the issue is DSC has a propriatary protocol between the keypad and the base. So has anyone messed with this before or can give me a few beginners tips on how to reverse engineer this protocol?

The wiring is simple: Vcc, GND, Data, Clock

The Vcc is +12 volts and the data/clk lines are between +8-10 but work just fine through a voltage divider to the logic analyzer.

The Clock line is confusing tho, its a 1kHz clock at 50% duty but only runs for 41.600ms then it goes high for 5.400ms and then starts over again.

The Data line appears to change on on either rising or falling edge of the clock

Open Door Data - Picture

(0 is the Data line, 1 is the Clock line)

OpenLogic Sniffer Files

  • \$\begingroup\$ This guy made an easy service. Still on beta, but works... juliano.com.br/dsc \$\endgroup\$
    – user23086
    Apr 26, 2013 at 3:40
  • \$\begingroup\$ I have some working code at github.com/hvesalai/keybus. It's under MIT License, so you are free to fork your own or contribute to mine. \$\endgroup\$
    – user134687
    Jan 1, 2017 at 18:37

5 Answers 5


There is no simple answer to decoding a protocol, if they have a good encryption scheme setup then you are probably going to be up &$%* creek. With some work and more questions you might successfully figure out the kind of encryption, and then, if it is poorly implemented, decode it.

Chances are that the keypad has a very simple protocol and the controller has some strict constraints on how many button pushes it will accept and such.

On the note of the synchronous protocol, chances are that the protocol is a NRZ protocol. That is my best informed guess based on your explanation. I cannot open the files right now, but I hope this helps.

The fact that it changes on both clock edges is just a sign that both clock edges represent a point that a "bit" of data occurs. With NRZ you are just checking if there was a change or not.

I hope this helped.

  • \$\begingroup\$ Thanks for that, I don't believe the data to be encrypted as another person on avrfreaks managed to find the bit that is set when the alarm is armed and unset when it isn't (hrm i can't put in newlines in this comment) www.baranharper.com/pdfs/dsc/pc5401-dev_guide.pdf <-- I believe this is the data that is being sent back and forth. So I know what I'm looking for just not exactly how to read it. Thanks for your comment again, hopefully I can spend some time on this project this weekend. \$\endgroup\$
    – mcd1992
    Mar 4, 2011 at 11:46
  • \$\begingroup\$ @User3239, I was sidetracked by work, if you save the data you pulled off of the data lines as an image on your computer it can be easily uploaded to the question, then users like myself whom cannot install non-work related software can look at it. \$\endgroup\$
    – Kortuk
    Mar 4, 2011 at 23:04
  • \$\begingroup\$ ah, sorry bout that. I can't embed a picture (10 rep limit) but i can link to one. \$\endgroup\$
    – mcd1992
    Mar 5, 2011 at 4:15

following my web search on this topic, it seems that this protocol is using the CLK line and then rising edge of CLK is for keypad->panel and falling edge for panel->keypad communication. I plan on testing this tonight with this small arduino sketch:

I'll repost my findings after this...

#define CLK 11
#define DTA 12

String st;

void setup()

void loop()
    if (waitCLKchange(1) > 200)
      // Debut de pattern

      st = "";

      while (1)
        // CLK est bas. On attend qu'il remonte
        if (waitCLKchange(0) > 50) break;

        // CLK est haut, on lit un bit
        if (digitalRead(DTA)) st += "1"; else st += "0";

        // Attendre que CLK redescende
        if (waitCLKchange(1) > 50) break;



int waitCLKchange(int currentState)
  int c = 0;
  while (digitalRead(CLK) == currentState)
  return c;

I went down this path, and found it was far, far easier to just buy one of the supported serial interface cards, such as the DSC 5401 or the newer IT-100.

For more info, see: http://www.payne.org/index.php/Product:DSC_5401

Note: if you had your alarm installed, your installer will have to come over and "register" the interface card on your KEYBUS network. I suspect the protocol may have some security features (I'd hope so), and that will make reverse engineering even harder.


It's starting to take shape. Here are a few results. Based on this post: http://www.avrfreaks.net/index.php?name=PNphpBB2&file=viewtopic&p=942340#942340 I'm looking at status strings, here is what I get:

00000101 0 10000001 00000001 00000000 11000111 00000000 11000111 00000000 11000111 1 no zone
00000101 0 10000001 00000010 00000000 11000111 00000000 11000111 00000000 11000111 1 zone 1
00000101 0 10000001 00000010 00000000 11000111 00000000 11000111 00000000 11000111 1 zone 2
00000101 0 10000000 00000011 00000000 11000111 00000000 11000111 00000000 11000111 1 zone 3
00000101 0 10000000 00000011 00000000 11000111 00000000 11000111 00000000 11000111 1 zone 4

00000101 0 10000011 00001000 00000000 11000111 00000000 11000111 00000000 11000111 1 arm delay
00000101 0 10000011 00001000 00000000 11000111 00000000 11000111 00000000 11000111 1 arm delay short beeps
00000101 0 10000010 00000101 00000000 11000111 00000000 11000111 00000000 11000111 1 armed

If you can help make sense out of this, I'd be happy!


What model of alarm panel is it? I did a similar thing years ago with a DSC PC1550 (Classic series panel) - nor sure how much has changed with the newer panels. The statement about rising edge clock vs the falling edge clock is correct - then each bit of data represented a keypad button or an LED on the keypad depending on data direction. I'm not sure why Zone 1 and zone 2 are the same and Zone 3 and Zone 4 - I was getting a definate bit set for each LED - good luck if You are still working on it.

  • \$\begingroup\$ Commentary answers do not fit the format of this site very well, perhaps edit to remove the question (which should be a comment) and expand on what worked for you. \$\endgroup\$
    – David
    Nov 23, 2014 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.