Interfacing with Eaton Home Heartbeat sensor (ZigBee + Mega64L)

Hopefully someone can help me with a little project I've started on. I'm not happy with any available home security systems and have decided to build my own. I have a bunch of Arduinos around, why not use one!

So, I decided on using some Xbee modules and was going to build my own sensors. But I found the discontinued Eaton Home Heartbeat uses Zigbee powered sensors and are nicer/cheaper than I can build on my own. I purchased a door sensor, and a motion sensor from a seller on ebay and cracked them open. They have a Mega64L and an Ember EM2420 IC on the board.

I would like to connect to UART on the Eaton sensor module to read the configuration of the zigbee (PAN ID, Mode, Keys etc) So I can get my Xbee module on an arduino to receive and process the events from the sensors. I powered the sensor from the 3.3v off an Arduino duemilanove and then removed the atmel 168 on the arduino. According to the Mega64L datasheet the rx/tx are pins 2 and 3 so I wired them to rx/tx pins on the arduino.

I get no love with this setup, No serial data, nothing when I send '+++'. Can anyone point me in the right direction? I'm thinking buying a freakduino to sniff the traffic over the air, but that just adds cost to my project.

So, it ends up the Home heartbeat sensors work on channel 9 which is outside of the ZigBee spec. Does anyone know how to force the XBee modules to run on channel 9? I can't figure out a way to for them down, I thinking the Digi firmware may not allow it.

I picked a couple of these up last year to mess around with and recently got some time to dive back in to the project. I'm documenting my progress on my blog; here's part 7: A basic teardown of the base station with pictures is here:

My blog has pictures and lots of technical details. My ultimate goal is to utilize the sensors as part of my Home Automation solution, and I'm speaking with several folks about building out an open replacement for the defunct Eaton HomeHeartbeat service. Eaton has been less than helpful in this process; repeated requests for technical information have gone unanswered. Fortunately the devices are pretty straightforward and are based upon well-documented components. I've got a prototypical Python application running at present speaking with the base station via USB...

The HomeHeartbeat hardware presents some interesting opportunities for hacking. The HomeKey dongle, for example, could be fun to hack; it contains an ATMega64L, an Ember ZigBee transceiver, a R/G backlit graphic LCD, click wheel interface, vibration motor, and a small LIPO battery. If you're interested in this stuff at all, check out my blog!

Regarding ZigBee, what the device refers to as "channel 9" is actually ZigBee channel 20. I've successfully monitored traffic between devices using an AVR RZUSBSTICK, the KillerBee stack, and WireShark.

For anyone that would like to use the Home Heartbeat via the Base Station USB port, you may be interested in the documentation I have written. I cover USB drivers, serial commands, and a full interpretation of the sensor state data. Check out the blog post at: