State Table of the Eaton Home Heartbeat

Eaton Dropped support for the Home Heartbeat system in 2011, and disabled their remote notification and monitoring service. They did not publish any information that would enable owners to continue receiving remote updates of their home status. In an attempt to fill that void, I am documenting the data available via the USB serial interface of the Base Station. The most important information available from this interface is the state table.

The state table can be retrieved by issuing an “S” command (upper-case S) through the USB interface. The state table contains information describing all of the devices within the Home Heartbeat system. Individual records can be retrieved by sending the “s” command (lower-case s). A series of “s” commands will retrieve records in sequential order. If an “s” command returns the last record, then the subsequent command will return the first record. There is no command that would permit retrieval of a specific state record.

A retrieved state record has the following format:

STATE="F1,F2,F3,F4,F5,F6,F7,F8,F9,F10,F11,F12,F13,F14,F15,F16,F17"

Where F1 through F17 are the returned data fields. Field 17 (F17) contains the ASCII text name of the device. All of the remaining fields are numerical and are expressed in hexadecimal notation (base 16). Here is an example of  a complete state table:

STATE="00,FF,0088,0001,00,00,00,00,0000,00,0000,00,00,00000000,00,,"
STATE="01,FF,0080,0010,0B,84,00,00,0000,00,0000,00,00,00000000,00,,"
STATE="02,00,0040,0002,00,12,00,00,0301,12,0000,00,FF,00000000,00,000D6F0000011367,Home Key"
STATE="03,01,0024,0003,01,A2,00,01,0000,5C,0000,00,FF,00000000,00,000D6F000009613E,Door"
STATE="04,03,0024,0018,01,A2,00,12,0000,60,0000,00,FF,00000000,00,000D6F000000F0CD,Tilt Sensor "
STATE="05,04,0034,0017,01,A2,00,00,0000,56,0000,00,00,00000000,00,000D6F000000FF00,Motion Sensor"
STATE="06,05,0024,0007,02,8F,00,00,0000,55,0000,00,FF,00000000,00,000D6F0000095BFC,Attention Sensor"
STATE="07,06,0034,0006,01,90,00,00,0000,4A,0000,00,0D,00000000,00,000D6F000000C70A,Reminder Sensor"
STATE="08,08,00B4,0004,02,84,00,00,0000,07,0000,00,01,00000000,00,000D6F000007A2C4,Power Sensor"
STATE="09,02,0024,0005,02,85,00,00,0000,58,0000,00,FF,00000000,00,000D6F000001060A,Water Sensor"

The remainder of this document describes the content and purpose of each field of a state record. There are companion documents for each device that identifies the specific values that are used in each field:

• Base Station
• Home Key
• Open/Closed Sensor
• Power Sensor
• Water Sensor
• Reminder Sensor
• Attention Sensor
• Base Station Modem
• Motion Sensor
• Tilt Sensor (aka Garage Door Sensor)

These are the only Home Heartbeat devices that I have available for evaluation. If I could buy or borrow other Home Heartbeat devices I would gladly add their support to these documents. I am aware that there is a Range Extender, Broadband Gateway, and a Water Shutoff Controller. There may have even been a temperature sensor of some sort. If I had access to these devices, it may significantly improve the interpretation of the state record fields.

Field 1: State Record ID

This is a reference number for the state record. This value is always zero (0x00) for the state of the Base Station network node, and one (0x01) for the Base Station Modem state record. All other network devices are numbered sequentially starting at two (0x02) as each state record is retrieved. You cannot assume that this number will be permanently assigned to a device. If you select “Forget Device” from a Home Key, the remaining devices will be renumbered to insure sequential numbering.

You might assume that the Home Key will always be numbered as two (0x02) since you have to add it to the system before you can add other devices. However, you can “Forget Device” the Home Key and re-add it at a new position.

Field 2: ZigBee Binding ID

This value is an index into the ZigBee Binding Table. The Home Heartbeat “p” command can be issued to retrieve the current ZigBee Binding Table from the Home Base.

Field 3: Device Capabilities

I have taken a leap-of-faith regarding the purpose of this field. What I can tell for sure is that the value is constant for a given device type. Observations have shown a correlation between device functionality and bit positions. The field has sixteen possible bits of which only the lower eight appear to be utilized.

Bit 0 (0x01)  –  unknown
Bit 1 (0x02)  –  unknown
Bit 2 (0x04)  –  Is a sensor
Bit 3 (0x08)  –  Is the Base Station
Bit 4 (0x10)  –  Can receive parameters (Motion, Power, and Reminder sensors)
Bit 5 (0x20)  –  Is a sensor
Bit 6 (0x40)  –  Is a Home Key
Bit 7 (0x80)  –  Is AC powered (Base Station, Modem, and Power Sensor)

If more device types could be tested, it may become clear why there are discrepancies such why two bits are identified as “sensor”. It may also be possible that this field identifies which devices are ZigBee nodes such as ZigBee Coordinator (ZC), ZigBee Router (ZR), and ZigBee End-Device (ZED).

Field 4: Device Type

A value indicating the the Home Heartbeat device type. Device types are numbered starting at one (0x0001). A value of zero (0x0000) is not a valid device type.

1 (0x0001)  –  Base Station
2 (0x0002)  –  Home Key
3 (0x0003)  –  Open/Closed
4 (0x0004)  –   Power
5 (0x0005)  –  Water
6 (0x0006)  –  Reminder
7 (0x0007)  –  Attention
16 (0x0010)  –  Modem
23 (0x0017)  –  Motion
24 (0x0018)  –  Tilt

Field 5: Device State

This field contains the last reported state of the device. All sensors report their state, but neither the Base Station nor the Home Key have been observed to have used this field. The Base Station Modem reports a variety of states here, however, with the cessation of the dial-up service, it is not possible to map these values.

Each of the sensors report either with bit 0 (0x01), or bit 1 (0x02) set to true. Please reference the specific sensor document for the description of each state.

Field 6: Device State Timer

This is the elapsed time since the device state has changed. This timer restarts at zero whenever the device sends a state message. See Appendix A: Timer Encoding, for the format of this field.

Field 7: Device Alerts

Individual bits of this field represent the various alerts that may arise for the device:

Bit 0 (0x01)  –  Alarm triggered; controlled by Field 9: Device Configuration
Bit 1 (0x02)  –  Device off-line, out of range, or battery dead
Bit 2 (0x04)  –  Low Battery signal sent during “I’m Alive” message from device
Bit 3 (0x08)  –  Battery charging; only valid for Home Key devices
Bit 5 (0x20)  –  Running on backup battery; only valid for Base Station

If the given bit is set to true then the device is in a state of alert for the associated condition.

Field 8: Device Name Index

This field contains a number representing the root name assigned to the device. The number is an index into a list of available names specific to the device type. Field 17 (Device Name) contains the complete name in text format, that may also include a letter suffix.

Field 9: Device Configuration

Each sensor, Home Key, and the Base Station have configurations values contained in this field. Please see the Home Key, and the Base Station documents for their specific configuration . Each of the sensors follow the same pattern for configuration as described in the following generalized discussion. See the device specific documents for the actual sensor configurations.

Sensor Alarms – Each sensor can be configured to alarm on either of two different conditions:

Bit 0 (0x0001)  –  Alarm enabled on condition #1
Bit 1 (0x0002)  –  Alarm enabled on condition #2

Only one or the other of the bits may be set at a time. When the sensor’s state matches the selected alarm condition, an alarm is generated on the Home Key and bit 0 of field 7 will be set to true.

Sensor Call me – Each sensor can be configured for “Call me” on either of two conditions:

Bit 8 (0x0100)  –  Call me enabled on condition #1
Bit 9 (0x0200)  –  Call me enabled on condition #2

Only one or the other of the bits may be set at a time. When the sensor’s state matches the selected  “Call me” condition, an alert message is transmitted via the Base Station Modem to the home owner’s email or cell phone. This functionality is no longer available since Eaton disabled the service in June 2011.

Field 10: Alive Update Timer

This is the elapsed time since that last “I’m Alive” message received from the device. All devices send these messages to the Base Station at regular intervals. For battery operated devices, this message contains a status of the battery. For all devices, this message serves to inform the Base Station of device readiness. See Appendix A: Timer Encoding, for the format of this field. Battery operated devices, excluding the Home Key, send the “I’m alive” message every 30 minutes. The Home Key sends its message according to its current battery update setting. AC powered devices, such as the Power Sensor, sends the “I’m alive” once every minute.

If this timer reaches two hours, the Base Station will assume there is a problem (possibly a dead battery) with the device. The Base Station will then raise an alert by setting bit 1 (0x02) of field 7 to true. When a fresh battery is inserted into a device, it will immediately transmit an “I’m alive” message, clearing the alert in field 7.

Field 11: Update Flags

This field is normally zero (0x00) for all devices. It has been observed to contain the value 0x80 when there is pending data needing to be sent to the device. Please read the description under Field 13: Device Parameter section below.

Field 12: Undefined

This 2 digit hexadecimal field has not been observed at any state other than all zeros. There is not enough enough information available at this time to identify its purpose.

Field 13: Device Parameter

This field may contain a user selectable configuration value. Only a few devices have the ability to accept a configuration parameter. Power, Reminder, and Motion are among those devices that have this ability. Each of these devices have menu items within the Home Key that permit selection of the configuration value.

The appearance of the selected value in this field does not necessarily reflect the current corresponding value known by the device. Field 11 (Update Flags) will contain the value 0x80 until the two are in sync. Field 15 (Pending Update Timer) contains the time that has elapsed since the user has selected the configuration value.

Synchronization occurs when the device contacts the Base Station to report a state change or an “I’m alive” message. Once the device has sent its message, it waits for a reply before going back to sleep. The Base Station sends a reply containing the user selected configuration data. Once the device and the Home Base are synchronized, both fields 11 and 15 are cleared to zero.

Field 14: Undefined

This 8 digit hexadecimal field has not been observed at any state other than all zeros. There is not enough enough information available at this time to identify its purpose.

Field 15: Pending Update Timer

This is the elapsed time since the user changed the device configuration parameter defined in Field 13. The fact that there is a non-zero value in this field is indication that the value has not yet been transmitted to the device. See Appendix A: Timer Encoding, for the format of this field.

Field 16: MAC Address

The IEEE 64 bit address known as the EUI-64(tm). The first 6 digits (24 bits) of this address consist of the Organizational Unique Identifier (OUI) as assigned by the IEEE to Eaton Electrical as 0x000D6F. This sequence appears at the beginning of all MAC addresses in a Home Heartbeat network. The remaining 10 digit portion (40 bits) serves to uniquely identify an individual device on Home Heartbeat network.

Field 17: Device Name

The name assigned to a Home Heartbeat network device. This name is manually selected, using the Home Key, from a list of available names for a given device type. A letter may be appended to the name to distinguish multiple devices used for identical purposes.

Appendix A: Timer Encoding

The Home Heartbeat uses a single 8-bit counter to track the passing of time. Each timer starts out counting in seconds, and gradually looses resolution as it advances. Once a timer passes the 59th second, it will only increment for each minute. Then once it passes the 59th minute, it increments by just an hour per count. After 24 hours, the timer will increment by one day.

The value of the timer fields, and their meaning are as follows:

• Values from 0 (0x00) to 59 (0x3B) represent 0 to 59 seconds
• Values from 64 (0x40) to 123 (0x7B) represent 0 to 59 minutes
• Values from 128 (0x80) to 151 (0x97) represent 0 to 23 hours
• Values from 160 (0xA0) to 255 (0xFF) represent 0 to 95 days

Note that I don’t know what the values above 167 really represent. I’m just guessing, as I have yet to let a timer run for more than a week.

It might help to understand this when written in pseudo-code:

     if (timer < 64)
              print (timer), " secs"
     else if (timer < 128)
              print (timer - 64), " mins"
     else if (value < 160)
              print (timer - 128), " hours"
     else
              print (timer - 160), " days"

Additional Notes provided by Nathan Heald for Undefined Fields 12 & 14

Currently it is not known conclusively what these fields are used for but we can do some more guessing. The documentation for the water shut off controller indicates that any sensor can be configured to activate the controller as well as being manually controllable from the Home Key. I surmise that one or both of these values are used for by the water shutoff controller. Documentation indicates that this “sensor” can be configured to be activated by any other sensor in the network. An “or”ed list of up to four sensors would fit nicely into field 14. Additionally, field 12 could hold a currently “open/closed” state or command when addressed to the water controller. Also this raises the importance of the Field 1 State Record ID. The ZigBee MAC address is the only other unique identifier for sensors and would be too long to use in fields 12 & 14. I would be interested to know if the water shutoff controller is thrown off if your device list is renumbered by “Forgetting” a device in your list. If not, perhaps the base station is smart enough to update the water shutoff controller with the updated record id’s of sensors which activate it should device renumbering take place.