I picked a couple of these up last year to mess around with and recently got some time to dive back in to the project. I'm documenting my progress on my blog; here's part 7:
http://buzzdavidson.com/?p=307 A basic teardown of the base station with pictures is here:
http://buzzdavidson.com/?p=261My blog has pictures and lots of technical details. My ultimate goal is to utilize the sensors as part of my Home Automation solution, and I'm speaking with several folks about building out an open replacement for the defunct Eaton HomeHeartbeat service. Eaton has been less than helpful in this process; repeated requests for technical information have gone unanswered. Fortunately the devices are pretty straightforward and are based upon well-documented components. I've got a prototypical Python application running at present speaking with the base station via USB...
The HomeHeartbeat hardware presents some interesting opportunities for hacking. The HomeKey dongle, for example, could be fun to hack; it contains an ATMega64L, an Ember ZigBee transceiver, a R/G backlit graphic LCD, click wheel interface, vibration motor, and a small LIPO battery. If you're interested in this stuff at all, check out my blog!
Regarding ZigBee, what the device refers to as "channel 9" is actually ZigBee channel 20. I've successfully monitored traffic between devices using an AVR RZUSBSTICK, the KillerBee stack, and WireShark.