Front Door Control System

History

The Original PowerBolt 1000

The original PowerBolt 1000 worked well for an unexpectedly large number of years. Unfortunately, the keypad started failing a couple years after losing a button and the only replacements in the same vein were a slightly more modern revision that User:Omegix procured that removed the "Open" and "Close" pads making the existing hack non-viable. If you're looking for documentation on the original door unlocking system, you can check out Home Automation.

Replacement With Schlage Encode

This is a great lock that is very much not amenable to maker hacking/control. There are ways to do it, but it's not great and requires dealing with a closed API that is subject to change.

Revisitation of the Newer PowerBolt 1000

This newer revision of the PowerBolt 1000 is missing the pads we were using with relays to easily control open and close of the deadbolt. Fortunately, it did have a 3 pin header with a jumper to select lock direction and a simple to decode key matrix from which the lock button could be triggered. With two relays, it was possible to reverse the lock direction and lock the door simultaneously affecting an unlock operation. Unfortunately, it has since failed in a weird state such that remote control still operates, but the keypad has become flaky (one button doesn't work causing people to push it harder and rip it off) and the the buzzer has changed pitch. I suspect I should have tossed a resistor inline with the relay for the lock side of the control, but I don't remember seeing any on the keypad flex circuit itself. In any case, this lock has now reached a busted, but still minimally operable status.

Replacement with Something New

Existing Keypad Locks

A selection of the Kwikset SmartCode locks have an expansion port for ZigBee or Z-Wave, especially in the older models. The lower end ones do not have this slot and are heavily stripped down to reduce cost. In addition, the keypads have moved to a 4-wire interface meaning that it is no longer a raw key matrix.

A touch keypad is nearly a must-have due to previous experience with rubber push buttons getting accidentally ripped off.

Hackability of locks:

• Kwikset Smartcode 260: Likely identical to the 270 with a different keypad
• Kwikset SmartCode 270: Purchased and returned, stripped down with no headers of any variety, very tiny control board
• Kwikset Aura: Unknown
• Schlage Encode: Not amenable to hacking at all
  • Can technically be remote controlled via undocumented web API, likely to break often and non-local
• Teeho TE001/2: Appears to be a relatively simple board without additional connectors.
• Teeho TE006: Appears to have lots of nice labeled pads and built-in BT. Used one purchased for $71.
• Other locks?

Teeho TE006

The keypad talks to the interior panel using I2C.

Unlock

Address: 0x5C

Data: A8 C5 A1 78 20 D0 38 EC D1 C2 82 EA B4 51 15 78 FC 4F 1C 6A 81 C2 D5 D1 CA 8F 49 7A C0 6C AF CD 09 81 EE 58 9B 06

Lock

Address Write: 0x5C

Data Write: A8 C5 A2 78 20 D0 BC 7C 85 D6 F1 D6 CB 71 E2 24 FA C3 13 E9 AA 10 54 2B 3E 42 5C BF 4A 9B 9D 1C 98 E1 A3 FA DF 5D

Followed by a second transaction (check bolt status?):

Address Write: 0xB8

Address Read: 0xB9

Data Read: B7 C6 A2 00 10 A6 A4 9F 69 FD 0A 40 7C 11 D1 BA 30 71 C5 EE 5E A5

Followed by a third transaction (check bolt status?):

Address Write: 0xB8

Address Read: 0xB9

Data Read: B7 C6 A2 20 10 A6 A4 9F 69 FD 0A 40 7C 11 D1 BA 30 71 C5 EE 5E 49

The data reads are likely lock status checks and the last byte of the status check is likely a checksum.

A Custom Solution

The appeal of existing keypad locks is that the keypad still functions with power/network being out. This is a critical feature and a hard requirement for any custom solution.

System Description

The core of the custom solution is required to be integrated to fulfill the requirement of being able to handle a power-out situation as no network will be available. This consists of a normally-secure electric strike on the main handle (non-deadbolt) and an exterior keypad with an interior box containing the control hardware with no involvement of the deadbolt during normal operation.

System Components

• Control Box
  • ESP of any flavor will do
    • Enough pins for communicating with and powering the keypad
    • Enough pins to control the electric strike relay
    • WiFi
      • Remote unlock
      • Remote code change
  • Electric strike relay
  • 12V -> USB car power converter to handle ESP
• Electric Strike
  • Embedded in the door frame
  • Located on the normal handle
  • Locked when unpowered
  • No nominal involvement of deadbolt
  • Easy to source and typically just 12V
• Power
  • Integrated into the control box? harder to do with 12V
  • Requires a 12V output to drive electric strike
  • Requires 5V or 3V3 to drive the ESP/keypad
  • This could be a small 12V battery with a trickle charger attached
• Keypad
  • Touch buttons instead of rubber
  • Some kind of feedback mechanism
    • Sound
    • Light
    • Both preferable
    • Needs to be used for both key entry and success/failure notification
  • Sourcing unknown
    • Use existing kwikset obsidian keypad?
  • Requires hole through wall to connect to control box
    • Another option would be ESPNow direct wifi connection, lots of unknowns
• Wiring
  • Up to 10 wires from control box to keypad, hopefully just 4 (power, ground, uart tx, uart rx)
  • 2 wires from control box to electric strike
  • 2 wires from 12V power source to control box (voltage converter inside)