The automated garage door can be opened by use of a proximity card. There is hardly any information available on how to add or remove cards from a JCM Technologies WAVE 500 motion control unit, annoying, since losing a card means someone now has access to your property.

System Overview

The system consists of an EVOProx card reader installed on the outside of the door, a WAVE 500 unit on the inside for access control, connected to a motor opening the garage door, and, one or more MOTIONCards. You swipe a 13.56 MHz MOTIONCard over the EVOProx card reader connected, by wire, to the WAVE unit. The unit looks up the card identifier and sends a pulse to the motor if the card is programmed in its internal memory.

Accessing the unit’s memory

WARNING: the WAVE 500 runs on 230 VAC. 230 Volt is a high and dangerous voltage to work with! Consult a licensed electrician before opening the unit.

The WAVE 500 motion receiver has 500 memory positions, meaning it can store 500 different proximity cards, more than enough for my little household. Cards can be added or removed from memory by opening the WAVE 500 unit’s case (4 standard Philips screws). This reveals a 4-digit display with 3 buttons labelled: 'C', ↑ and ↓. The alternating dots on the display show the unit is powered on.

Press one of the 3 buttons to activate the menu, the display shows 4 zeroes. The digits can be incremented with the ↑ button, the ↓ button moves to the next position and the 'C' button confirms the entered number.

A PIN is required to access the menu. Nor JCM Tech nor the vendor would give me the code for my unit. Annoying since we lost a card that still had access to our house. A fair bit of internetting later learned me the PIN is printed on the circuit board itself! The module that sticks out underneath the display is the memory module with the 500 memory positions. Power-off the unit and pull the memory module out of the board and look for the sticker with the 4-digit PIN.

Adding and removing MOTIONCards

Enter the PIN and confirm with the 'C' button. An incorrect PIN shows an 'Err' message, a correct one shows 'Mod1'. There are 2 modes: 'Mod1' or basic mode and 'Mod2' or advanced mode. Toggle modes with the ↑↓ buttons, confirm with the 'C' button.

Mod1 (basic mode)

The display shows '001' or the first memory position. A dot on the bottom right of the number indicates the position is taken by a MOTIONCard. Other positions can be select by pressing the ↑↓ buttons.

Pressing the 'C' button on a stored memory position (one with a dot) empties that position. The card stored on that memory position has now been revoked. Swipe a card over the EVOProx reader when an empty position (no dot) is shown to store it on that position. This card has now been granted access.

Move to a '----' position and press the 'C' button to exit or wait 60 seconds.

Mod2 (advanced mode)

Is still a bit of a black box at the moment. I'll update this article when I learn more.

Exiting

The programming mode exits automatically after 60 seconds of no activity with 2 short beeps.

Open Questions

It took me a bit of trial & error to understand how the JCM Tech WAVE 500 works and the relay on the unit’s board hint at more features I have yet to discover. A list of questions still waiting to be answered.

• How does encryption work? I think it uses a rolling key, the card is passive, so how can an identifier “roll”?
• Why can't I read out a MOTIONCard with the NFC reader I tested? Is it using HF RFID at 13.56 MHz?
• There is a BUS-LIN (sometimes referred to as BUS-L) terminal on the WAVE ACCESS unit. I assume I can be used to receive signals from the unit, can I read that out in some way? Is it a Wiegand interface?
• Are there open-source/open-hardware alternatives that offer a secure alternative and are better documented?
• What’s the use of the PIN if it's printed on the memory module? Preventing remote programming?