Daniel Kucera on Danman’s Blog posts about reverse engineering digital door phones by Tesla (the phone company, not the car company) which utilize a proprietary two wire protocol.

I wanted to be notified when someone rings when we are not at home so I decided to reverse engineer it.

During idle, there is a voltage of about 23V which is there to power the phones as they don’t have any other power supply; during a call, the voltage drops to about 12,6V and current goes to 47mA. So I took my scope and started to measure the signal. In short, I have found, that there is some sort of digital signal and analog voice modulated on top of the DC component (timeframe of one call).

The data is encoded using symbols consisting of 4 PWM pulses. There are 3 symbols – logical 0, logical 1 and stuffing (‘-‘). Each frame starts with several dozens of stuffing symbols. Then bit symbols are sent each one followed by one stuffing symbol. On the picture above, “A” marks the start of 1 then follows: -, 1, -, 0, -, 0, … Each frame consists of 48 bits where the last 8 bits are checksum.

An Orange Pi is used to decode the signals.

You can read the details in the post here and see the software on GitHub.