Intercom equipment in new buildings is now a prerequisite, and in old houses it is. This significantly increases the safety of residents and helps maintain order in the entrance. But what if the key to the intercom is lost or broken? Previously, installer companies were monopolists and raised the price of backup devices, now there are many companies and workshops that can rewrite the key to the intercom for a relatively small amount. However, the same steps can be performed independently.
There are two main ways to obtain a new key, depending on the type of devices used - this is the introduction of a code into the intercom system.
touch memory
Touch memory is a non-volatile identifier that includes a memory device, a real-time clock and accumulator battery. Reading or writing information is done by simply touching the body of the device. There are many varieties of Touch memory. They differ not only, but also models in terms of memory size. Compatibility with the installed equipment must be considered when purchasing blanks for writing codes.
Touch memory models
The Dallas model is the most common model. The plastic holder can bear the emblem or inscription of the intercom equipment manufacturer: Sean, Eltis, Vizit or the Dallas logo. To copy the code, TM2004 blanks are used.
Some Vizit intercom systems do not support work with TM2004 blanks, in this case you can use the more expensive universal model TM08.
- Metacom model. Domestic production, are a complete analogue of the Dallas model. Fully match the electrical characteristics. They must be marked both on the plastic holder and on the metal case of the device itself - the inscription Metakom or MT. Workpieces TM2004 and TM08 are suitable.
- Model "Cyfral". They have a similar inscription on the holder. TM2004 blanks are suitable for older models, TM7 for new ones. Resistor model "Digital". Outdated equipment, which is quite rare. Such devices do not have a chip with a recorded code. They use a resistor with a rating corresponding to a particular intercom. You can distinguish such a device by the recess located in the central part of the case. Copying is done by soldering the appropriate resistor to any of the Touch memory blanks. Its capacity is determined by an ohmmeter using a working key.
Contactless RFID
Recently, contactless reading systems have become widespread, where RFID keys or proximity cards are used. Outwardly, they resemble an ordinary plastic keychain or bank card. The devices do not have their own power supply. The transmission of the code to the receiving device is carried out after receiving the radio signal, the energy of the wave radiation and acts as an energy supply. Therefore, activation occurs only at a distance of 10-15 cm from the lock. Otherwise, the device and the action of the tag do not differ from the similar Touch memory.
The keys themselves look like key fobs no larger than a five-ruble coin and 5 mm thick. Contactless cards have a format similar to bank cards and are somewhat thicker - up to 3 mm. The interchangeability of cards and key fobs, despite the same functioning technology, is not always feasible, since a violation of the intensity of the transmitted signal is possible. On the this moment to copy RFID keys various manufacturers almost any workpiece is suitable: HID Prox II, EM-Marin, Indala, etc.
Recording on a workpiece
on media is carried out using special devices, programmers. For example, the Keymaster PRO 4 RF device is a universal programmer for both the Touch memory standard and contactless RFID devices. Allows you to copy keys to blanks:- RW/TM 2004;
- CS 1, 3;
- TM - 01, 07, 08;
- RW 1990, 2007, 125RF.
Supports the standards of the most common manufacturers:
For touch memory:
- Cyfral;
- Dallas;
- For RFID:
- HID ProxII;
- EM Marin;
- Indala and some others.
Recording of the workpiece is done with one touch. The algorithm for copying the key is as follows:
- A key is brought to the reader, which must be copied.
- The device independently determines the type, manufacturer and model of the recommended workpiece.
- The blank is brought to the reader. And the record button is pressed.
- The key is being written to.
In addition, the device can record without a source key if the code stored in memory is known. The duplicator is connected to the PC via USB port and has its own software that stores 500 recent entries, and manages the distribution of Touch memory and RFID records. This is beyond the reach of most ordinary users, but there are simpler models with limited functionality:
- Key Master 3;
- KeyMaster 3 RF - supports contactless tags;
- TMD-5 RFID;
- TM Pro.
Intercom programming
Entering information about new keys can also be carried out directly on the intercom equipment. Naturally, at different manufacturers various instructions for programming intercoms have been developed.
Entering information into the intercom memory is possible only if the installers have not changed the factory access code in the device. Usually, installers rarely change the access password, and most of the default passwords are 1234.
Manufacturer Raimann
- To enter the settings - the reader button is pressed;
- Login password from 9 to 4, after (wait 10-15 seconds) dial from 1 to 6;
- The symbol "P" appears on the monitor;
- Menu items from 2 to 8. The item responsible for the introduction of new keys No. 2.
Manufacturer VIZIT
- Entering the settings - # 99 is typed on the keyboard;
- After sound signal, password 1234 is entered, then the signal again;
- Programming and prescribing new keys - point number 3;
- The apartment number is entered, the key is applied and # is pressed;
- Then press * to switch to operating mode.
If there are no * and # buttons on the keyboard, then they are replaced by the C and K buttons, respectively.
Manufacturer Eltis
- To enter the menu, press button B, keep it pressed for 7 seconds;
- System password 1234;
- After the menu loads on the screen, select the “Key master” item;
- We dial the apartment number and press the button B;
- After the LF command appears on the screen, you need to lean the key against the reader;
- The recording is completed if the message ADD appears on the screen (if there were no keys for this apartment in memory before) or the apartment number.
The failure of the key from is a very rare phenomenon, if we consider the so-called tablets, and very likely, if we are talking about a contactless RFID system built on triggered long distance maps.
If for some reason the entrance door, the gate of a private house or the lock at work has ceased to be unlocked, the question often arises: how to reprogram the intercom key? This process for an ordinary user does not mean at all a complex intervention and participation in the programming of a personal identification device.
Features of programming intercom keys
To understand why programming individual intercom keys only includes writing a new identifier and linking it to the subscriber on the device installed in the door, it is worth paying special attention to the mechanics of work and the internal structure of familiar tablets and cards.
All keys are built on the scheme of a one-time device. If there is a failure or physical violations of the internal structure, the personal identifier is simply thrown away or destroyed. Neither repair nor reprogramming without the use of special industrial devices is provided.
RFID
Small key chains, cards are already familiar to many people. To operate such a key, it does not need to be leaned against the reading pad. It is enough just to bring it to a certain distance.
According to the range of operation, the keys are ranked:
- with an identification zone of 100-150 mm, a common format, Proximity type;
- with a detection range of up to 1 m, type Vicinity.
Despite such differences in range, the operation of all identifiers follows a simple scheme.
An intercom using keys of this class has a low-intensity electromagnetic field radiation unit in the contact pad area. Inside the RFID card or key fob is located simple circuit, it includes an inductive oscillatory circuit, a miniature transmitting antenna and a chip that generates a signal.
When the key is introduced into the radiation zone, energy is generated, the internal electrical circuit is activated. The card or key fob transmits a radio frequency signal, the intercom recognizes the identifier and unlocks the door if it is registered in its memory.
An easy way to reprogram an RFID-class intercom key simply does not exist for most types of products. The identifier is formed by a chip sprayed in the factory, the number of unique combinations (cards and key fobs) is huge, no changes in the code are foreseen.
The key can deteriorate both due to mechanical bends, kinks (as a result, the chip or the transmitting grid of the antenna is damaged), and due to exposure to strong electromagnetic radiation, comparable in strength to a microwave oven.
Touch Memory
Touch-Memory are contact tablets familiar to most people. A microchip is also located inside such a key.
However, the identifier is transmitted according to an electrical single-channel scheme. At the moment the key is applied to the contact pad, the data reading circuit is closed in the intercom.
A unique code stitched into the tablet is transmitted and checked for compliance with one of those stored in the device's memory. If the identification has passed, the door will be unlocked.
Touch-Memory tablets can be damaged by exposure to strong static electricity by applying the tablet to electrified clothing. This is quite difficult to do, since the impulse must pass between certain points of the contact pad, but this cause of breakdowns is the most common.
A tablet with a chip is very durable, it is mechanically difficult to damage it, the key, in addition to the effects of static, can be burned in the microwave. Any other influences, including the most powerful neodymium magnets - Touch-Memory endures without consequences.
The way to program access keys for a doorphone of this class is to use a special programmer. With its help, clones of tablets are made, as well as universal master keys for a series of intercoms.
Touch-Memory are divided into classes. They do not depend on the internal structure and principles of operation, but on manufacturers, each of which creates an internal circuit with certain characteristics and a unique code generation methodology.
The following types of Touch-Memory are widely used:
- with markings starting with DS (Dallas) are used in a huge number of models Vizit, Eltis, C2000 and others;
- with DC marking, as well as Cifral KP-1 - Touch-Memory data is intended only for Cifral intercoms;
- K series, widely used in Metacom access control systems and other intercoms.
Similarly, there are classes, RFID formats, for example, the oldest HID, the popular EM-Marin, and also used in Mifare cards that work from a long distance. Therefore, before figuring out how to program a personal key from an intercom from an entrance door, you first need to purchase a Touch-Memory or RFID compatible format.
Do-it-yourself intercom key programming
The technique of how to encode a personal key from an intercom from work, at home or at the entrance of friends consists only in writing the data of the corresponding personal identifier into the memory of the device controlling the door. To do this yourself, you need to access the service functions from the front panel keypad.
The masters installing the intercom are required to reprogram and change the factory master codes and other service information of the device.
If this is done, the methods of how to register your key in the intercom using standard access combinations will not work. However great amount devices on the door - respond to factory codes and allow you to activate service functions.
Action algorithm
The easiest way is to find out how to encode the key to the intercom from the entrance door at the service company. Some of them provide such data.
But there is a set of standard actions for intercoms of common brands.
- Rainmann, Raikman - the call is pressed, 987654 is entered, after the beep - 123456. If the P prompt appears on the display - 2 is pressed, a tablet is applied, # is pressed,<номер квартиры>, #. Recording in memory is done with the * button;
- - #-999 is dialed, after the invitation sound, code 1234 is dialed (for some series - 6767, 0000, 12345, 9999, 3535). After that, 3 is pressed, after a pause - the apartment number, a key is applied, #, * is pressed. If the factory code (1234 and others) is not accepted, the intercom will emit a two-tone signal;
- , - hold the call button until the reaction (sound, invitation on the display), enter 1234, then the apartment number, call. In response to an invitation to lean the key, exit the menu by pressing the * button.
The most modern versions of the Cifral intercom use quite complex code sets. The method of how to encode the key from the intercom from the entrance door looks like this: call, 41, call, 14102, 70543.
Then you should wait for the invitation to appear on the screen, press 5, enter the apartment number, after the inscription on the Touch display, attach the key. An audible signal indicates that the memory has been written to.
Conclusion
You can write to the memory of the intercom any of the purchased keys, which are mistakenly called blanks. In reality, it is a working mechanism with its own unique code. It only needs to be registered on the access device.
A variety of keying techniques are available. The same one can be used on several intercoms of the same brand, provided that registration is made on each. The main thing is that the Touch-Memory tablet or RFID card, key fob should be compatible with the device on the door.
Video: How to make a duplicate key from the intercom
Good afternoon! Somehow I got tired of paying 150 rubles for a copy of the intercom key and decided to assemble a simple, budget iButton duplicator on Arduino. The prices for such ready-made devices “bite”, although their functionality is wider, they copy almost everything, including wireless dongles. A simple copy of the iButton key a la "button" is enough for me. Interesting? Please under "cut"!
So let's get started! To begin with, "technical assignment", what should this device be able to do:
1) Read the contents of the key, it's interesting what is sewn up there.
2) Copy the keys, no matter how strange it sounds :)
3) Flash the "universal" key. By the word "universal" we mean any of our own keys, which will be recorded by default.
UPD. Very important! If the first byte, family code, is 00
, for example 00
:12:34:56:AB:CD:EF: AA, then after the firmware the key will “die”, it will not be read by this programmer, and possibly by others. Found by experience, thanks to a friend 16 :AB:CD:EF:E0 with a naturally incorrect checksum E0. Since the checksum is incorrect, the intercom ignores this sequence when reading. This intercom ruined all rewritable keys, while I figured out what was going on and why the data in the keys “by itself” changes. As a result, it was not possible to make a duplicate for this intercom, I had to go to a service organization and order a key for 100 rubles. :)
As a result, we get a thing useful in the household for ridiculous money, “blanks” for recording are sold, although we can find offline for 30 rubles apiece, for copiers on the market for 100 - 150 rubles :).
UPD. We read about what types of keys can be written with this duplicator. Thanks for the help comrade.
UPD. If the key is not written, follow the comrade. I plan to buy +197 Add to favorites Liked the review +95 +184
Each intercom key has its own number - it is this number that serves as the key identifier. It is by the number of the key that the intercom decides - its own or someone else's. Therefore, the copying algorithm is as follows: first you need to find out the number of the allowed key, and then assign this number to another key - the clone. For the intercom, it makes no difference whether the original key or its copy was attached. After checking the number with his database of allowed numbers, he will open the door.
Intercom keys that we will connect to the Arduino (they are sometimes called iButton or touch memory) are read and written via 1-wire interface. Therefore, the connection scheme is very simple. All we need is a couple of wires and a 2.2 kΩ pull-up resistor. The connection diagram is shown in the figure.
Assembled Circuit might look something like this:
2 Read iButton Key ID using Arduino
To work with the 1-wire interface, there are ready-made libraries for Arduino. You can use, for example, this one. Download the archive and unpack it into a folder /libraries/ located in the Arduino IDE directory. Now we can very simply work with this protocol.
Upload to Arduino in a standard way this sketch:
iButton key reading sketch with Arduino (expands) #includeThis sketch shows the key number for the intercom that is connected to the circuit. This is what we need now: we need to find out the number of the key we want to make a copy of. Let's connect the Arduino to the computer. Let's start the serial port monitor: Tools Serial Port Monitor(or keyboard shortcut Ctrl+Shift+M).
Now let's connect the key to the circuit. The port monitor will show the key number. Let's remember this number.
And here is what exchange takes place on a single-wire line when reading the key identifier (for more details, see below):
The figure, of course, does not show all the implementation details. Therefore, at the end of the article, I attach a timing diagram in the *.logicdata format, taken with the help of a logic analyzer and the program Saleae Logic Analyzer and opened to her. The program is free and can be downloaded from the official Saleae website. To open the *.logicdata file, you need to run the program, press Ctrl + O or in the menu Options(located at the top right) select an item open capture / setup.
3 Dallas Key Identifier Record using Arduino
Now let's write a sketch for writing data to the memory of the iButton key.
iButton key writing sketch with Arduino(expands) #includeDon't forget to set the number of your original key in the array key_to_write which we learned earlier.
Upload this sketch to the Arduino. Open the serial port monitor (Ctrl+Shift+M). Let's connect a key to the scheme, which will be a clone of the original key. The serial port monitor will display a corresponding message about the result of programming.
If this sketch didn't work, try replacing the code after Serial.print("Start programming...") until the end of the function loop() to the next one:
Additional sketch for writing iButton key using Arduino(expand) delay(200); iButton.skip(); iButton.reset(); iButton.write(0x33); // read current key number Serial.print("ID before write:"); for (byte i=0; i<8; i++){ Serial.print(" "); Serial.print(iButton.read(), HEX); } Serial.print("\n"); iButton.skip(); iButton.reset(); iButton.write(0xD1); // команда разрешения записи digitalWrite(pin, LOW); pinMode(pin, OUTPUT); delayMicroseconds(60); pinMode(pin, INPUT); digitalWrite(pin, HIGH); delay(10); // выведем ключ, который собираемся записать: Serial.print("Writing iButton ID: "); for (byte i=0; i<8; i++) { Serial.print(key_to_write[i], HEX); Serial.print(" "); } Serial.print("\n"); iButton.skip(); iButton.reset(); iButton.write(0xD5); // команда записи for (byte i=0; i<8; i++) { writeByte(key_to_write[i]); Serial.print("*"); } Serial.print("\n"); iButton.reset(); iButton.write(0xD1); // команда выхода из режима записи digitalWrite(pin, LOW); pinMode(pin, OUTPUT); delayMicroseconds(10); pinMode(pin, INPUT); digitalWrite(pin, HIGH); delay(10); Serial.println("Success!"); delay(10000);Here the function writeByte() will be as follows:
int writeByte(byte data) ( int data_bit; for(data_bit=0; data_bit<8; data_bit++) { if (data & 1) { digitalWrite(pin, LOW); pinMode(pin, OUTPUT); delayMicroseconds(60); pinMode(pin, INPUT); digitalWrite(pin, HIGH); delay(10); } else { digitalWrite(pin, LOW); pinMode(pin, OUTPUT); pinMode(pin, INPUT); digitalWrite(pin, HIGH); delay(10); } data = data >> 1; ) return 0; )It is pointless to show the timing diagram of the operation of the key identifier recording sketch, because it is long and will not fit in the picture. However, the *.logicdata file for the logic analyzer program is attached at the end of the article.
Intercom keys come in different types. This code is not suitable for all keys, but only for RW1990 or RW1990.2. Programming keys of other types can lead to key failure!
If desired, you can rewrite the program for a key of a different type. To do this, use the technical description of your key type (datasheet) and change the sketch in accordance with the description. Download datasheet for iButton keys can be attached to the article.
By the way, some modern intercoms read not only the key identifier, but also other information recorded on the original key. Therefore, making a clone by copying only the number will not work. You need to completely copy the key data.
4 Description of single wire 1-Wire interface
Let's take a closer look at the One-wire interface. In organization, it is similar to the I2C interface: it must also contain a master device (master) that initiates the exchange, as well as one or more slave devices (slave). All devices are connected to one common bus. iButton devices are always slaves. The master is usually a microcontroller or PC. The data rate is 16.3 kbps. The idle bus is at logic "1" (HIGH). This protocol provides only 5 types of signals:
- reset pulse (master)
- presence pulse (slave)
- write bit "0" (master)
- write bit "1" (master)
- read bit (master)
1) Initialization
Initialization consists in the fact that the master sets the reset condition RESET (lowers the line to "0" for a period of 480 μs or more, and then releases it, and due to the pull-up resistor, the line rises to the state "1"), and the slave no later than 60 µs after that, it must confirm the presence by also lowering the line to "0" for 60 ... 240 µs and then freeing it:
2) Commands for working with ROM
If no acknowledgment signal is received after the initialization pulse, the master repeats the polling of the bus. If the confirmation signal is received, then the master understands that there is a device on the bus that is ready for the exchange, and sends it one of the four 8-bit ROM commands:
(*) By the way, there are quite a few families of iButton devices, some of them are listed in the table below.
iButton family codes(unfolds)| Family code | iButton devices | Description |
|---|---|---|
| 0x01 | DS1990A, DS1990R, DS2401, DS2411 | Unique serial number-key |
| 0x02 | DS1991 | Multikey, 1152-bit secure EEPROM |
| 0x04 | DS1994, DS2404 | 4 kb NV RAM + clock, timer and alarm |
| 0x05 | DS2405 | Single addressable key |
| 0x06 | DS1993 | 4 KB NV RAM |
| 0x08 | DS1992 | 1 KB NV RAM |
| 0x09 | DS1982, DS2502 | 1 kb PROM |
| 0x0A | DS1995 | 16 KB NV RAM |
| 0x0B | DS1985, DS2505 | 16 KB EEPROM |
| 0x0C | DS1996 | 64 KB NV RAM |
| 0x0F | DS1986, DS2506 | 64 KB EEPROM |
| 0x10 | DS1920, DS1820, DS18S20, DS18B20 | temperature sensor |
| 0x12 | DS2406, DS2407 | 1 kb EEPROM + dual channel addressable key |
| 0x14 | DS1971, DS2430A | 256 bit EEPROM and 64 bit PROM |
| 0x1A | DS1963L | 4 KB NV RAM + write cycle counter |
| 0x1C | DS28E04-100 | 4 KB EEPROM + dual channel addressable key |
| 0x1D | DS2423 | 4 KB NV RAM + external counter |
| 0x1F | DS2409 | Two-channel addressable key with the possibility of switching to the return bus |
| 0x20 | DS2450 | Four-channel ADC |
| 0x21 | DS1921G, DS1921H, DS1921Z | Thermochronic sensor with data acquisition function |
| 0x23 | DS1973, DS2433 | 4 kb EEPROM |
| 0x24 | DS1904, DS2415 | Real time clock |
| 0x26 | DS2438 | Temperature sensor, ADC |
| 0x27 | DS2417 | Real time clock with interrupt |
| 0x29 | DS2408 | Bidirectional 8-bit I/O port |
| 0x2C | DS2890 | Single channel digital potentiometer |
| 0x2D | DS1972, DS2431 | 1 kb EEPROM |
| 0x30 | DS2760 | Temperature sensor, current sensor, ADC |
| 0x37 | DS1977 | 32 KB password protected EEPROM |
| 0x3A | DS2413 | Dual Channel Addressable Switch |
| 0x41 | DS1922L, DS1922T, DS1923, DS2422 | High-resolution thermochronic and hygrochronous sensors with data acquisition |
| 0x42 | DS28EA00 | Digital thermometer with programmable resolution, serial link capability and programmable I/O ports |
| 0x43 | DS28EC20 | 20 kb EEPROM |
Data is transmitted sequentially, bit by bit. The transmission of each bit is initiated by the master. When recording, the leader lowers the line to zero and holds it. If the line holding time is 1…15 µs, then bit "1" is written. If the hold time is 60 µs or more, bit "0" is written.
Reading bits is also initiated by the master. At the start of reading each bit, the master pulls the bus low. If the slave wants to send a "0", it holds the bus in the LOW state for 60 to 120 µs, and if it wants to send a "1", it keeps the bus in the LOW state for about 15 µs. After that, the slave releases the line, and due to the pull-up resistor, it returns to the HIGH state.
This is how, for example, the timing diagram of the Search ROM (0xF0) search command looks. Bit writing commands are marked in red in the diagram. Pay attention to the order of the bits when transmitting over 1-Wire: the most significant bit is on the right, the least significant bit is on the left.
3) Commands for working with PROM
Before considering the commands for working with the iButton PROM, it is necessary to say a few words about the dongle memory structure. The memory is divided into 4 equal sections: three of them are designed to store three unique keys, and the fourth is for temporary data storage. This temporary buffer serves as a kind of draft where data is prepared for writing keys.
To work with the PROM, there are 6 commands:
| Name | Team | Purpose |
|---|---|---|
| Write to temporary buffer (Write Scratchpad) | 0x96 | Used to write data to a temporary buffer (scratchpad). |
| Read from temporary buffer (Read Scratchpad) | 0x69 | Used to read data from a temporary buffer. |
| Copy from temporary clipboard (Copy Scratchpad) | 0x3C | Used to transfer data prepared in a temporary buffer to the selected key. |
| Write key password (Write Password) | 0x5A | Used to record the password and unique identifier of the selected key (one of three). |
| Write a key (Write SubKey) | 0x99 | Used to directly write data to the selected key (bypassing the temporary buffer). |
| Read Key (Read SubKey) | 0x66 | Used to read the data of the selected key. |
4) Data transfer
To be continued...
5 Possible mistakes when compiling the sketch
1) If an error occurs while compiling the sketch WConstants.h: No such file or directory #include "WConstants.h", then, as an option, follows in the file OneWire.cpp replace the first block after the comments with the following:
#include
2) If an error occurs during compilation class OneWire has no member named read_bytes, then find and try to use another library to work with the OneWire interface.