This post documents my research into the HHB sensors, complete with pretty pictures. With the exception of the power sensor, these devices are all variations on a similar theme. They all contain the same Atmel ATMega64L MCU and Ember EM2420 ZigBee/802.15.4 wireless chip with supporting devices. There are some minor variations in the area of the board which interfaces with the particular sensor function (magnetic switch for open/close sensor, header for tilt sensor, etc.) The footprint of the ATMega64L and utilized pins are identical across all of the sensors, as is the magnetic reed switch (for HomeKey sensing/registration), crystals, and ZigBee antenna.
Power Sensor
As configured, this sensor simply reports whether or not a load is active on the device plugged in. Device class is reported as (id: 0004). State reports (state: 1) when load is off and (state: 2) when load is turned on.
The internal design leads me to believe that the device was originally intended to me much more fully featured than what was actually shipped:
This is an interesting design, and I believe that it’s capable of a lot more than is being utilized at present. Looking at the front side of the board in this image, you will notice four main sections: The MCU with the ATMega64L and ICSP header, the RF section with the EM2420 ZigBee chip and supporting components, and a bunch of other components. After following traces on the board and consulting a couple of datasheets I realized that these remaining components actually provide two discrete functions. First, the majority of the remaining components allow the sensor to be directly powered via AC mains voltage. This function is primarily provided by U5, which is a LNK305 switching IC. The final function provided is load sensing, which is performed by a large current transformer (CT), which is an AC-1005 5 Amp Current Transformer from Talema India. Output from this CT is converted to DC via a small HD04 Bridge Rectifier which then presumably feeds in to the ATMega64. I was unable to find the specific analog pin which reads this value, though PC0 and/or PC1 are likely candidates.
What this means, ultimately, is that it should be possible to measure actual current consumption for the load plugged into the device rather than simply reporting an “on/off” state condition. The fact that the device configuration available through the HomeKey provides several different sensitivity profiles tells me that the output of the rectifier is indeed being measured. Whether this omission was due to cost cutting efforts, safety concerns, or limitations of the rest of the stack is unknown.
Another interesting point worth noting are the empty footprints at U7 and U8 on the back of the device; this layout is identical to the footprint for the IS62LV256 static RAM used on the base station. Perhaps this was intended to support more advanced load tracking / current consumption metrics?
Moisture Sensor
Sensor utilizes simple dry contacts to determine wet conditions. Device class is reported as (id: 0005). When the pins on the remote sensing puck are shorted, the device reports (state: 2); otherwise it reports (state: 1). This is a transmit-only sensor.
Reminder/Attention Sensor
These two sensors perform nearly identical functions and are absolutely identical physically. Device classes are reported as (id: 0006) and (id: 0007), respectively. I still need to document the state transitions for these two devices. Ultimately I question their usefulness. From a user interaction perspective, they blink a light until the button is pressed. Time between initial trigger and new states is configurable. These sensors both transmit and receive data; they contain a button which sends a message to the base station when pressed, and they also have a single green LED which indicates status.
Motion Sensor
Simple passive infrared (PIR) motion sensor. Device class is reported as (id: 0017). Reports (state: 1) when no motion detected, and (state: 2) when motion has been detected. No additional alerts are transmitted if additional motion occurs within configured delay. After motion is detected, the sensor will send a new (state: 1) alert when no motion has been detected within the configured delay. This is a transmit-only sensor.
Garage/Tilt Sensor
This is a simple tilt sensor. Device class is reported as (id: 0018). Reports (state: 1) when vertical, (state: 2) when tilted to horizontal. This is a transmit-only sensor.