Arduino Forum

Topics => Device Hacking => Topic started by: Mauzer on Apr 16, 2012, 06:45 pm

Title: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Apr 16, 2012, 06:45 pm
Hello,

Has anyone tried to decode Paradox Spectra Security Systems serial interface? My plan is to get activity reports via Spectra's serial interface with JeeNode. I connected my JeeNode to Spretra's serial interface and successfully managed to transfer serial data packets to JeeLink. But I need to decode this serial communication...  :smiley-roll:
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Dene on Jul 18, 2012, 05:37 pm
I want to know how too
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: tincanman on Aug 24, 2012, 02:54 am
well, if you can successfully communicate with it via serial, then you should be able to grab the serial data. Determine the baud rate and you should be good to go.
Then try and see if there are any patterns in the data (meaning that it is a packet based communication).
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: ldjohn on Sep 19, 2012, 02:45 pm
Hi there, if you get the PRT3 module, you can have all the content sent to you over a serial bus, in either ascii or c-bus format.

http://www.paradox-alarm-systems.com/en/p/433/paradox-prt3-

regards
John
:D
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Thomas80 on Jul 13, 2013, 12:41 pm
Hello,
I'm trying to comunicate with Paradox alarm system via serial connector (programming connector).
My idea to decode the protocol is to capture serial packets sent from winload (default paradox programming software).

How you have connected the paradox serial connector to the PC/Arduino serial port?
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jul 13, 2013, 05:27 pm
Yes, I have. I tried to look at the packets sent by Paradox, but somehow forsaken this activity :~
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Thomas80 on Jul 13, 2013, 06:09 pm
I cannot comunicate with the alarm system. Can you help me?
The pcb serial is RS232 or RS485? I can comunicate directly from a PC serial or I need an interface?
My PC mount a RS232/485 card.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jul 13, 2013, 07:20 pm
You need only simple RS232 To TTL Converter for communication between Paradox and computer.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Thomas80 on Jul 15, 2013, 08:56 am
Thank you. I have built the pcb and the comunication is working.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jul 15, 2013, 09:10 am
Very good. It's time to decode the packets. But the question is HOW?  :)
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Thomas80 on Jul 15, 2013, 11:49 am
I have the Paradox programming software (Winload). I try to sniff the packets.
I have also received from Paradox the ASCII and CBUS protocol documentation. I don't know if the data exchanged via serial connector uses one of this protocol specifications.
If needed I can send to you the documents.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jul 15, 2013, 11:56 am
It would be great to get these documents.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Aug 12, 2013, 08:42 am
Thomas80,

Have you managed something?

I tried to sniffer this system’s serial interface and found that one packet length is 37 bytes. The first 6 bytes are always the same. When zone status changes then the 9th byte is zone number. From 16th to 31th is reported zone’s name. What means other bytes I have not managed yet.

And found similar testing on the web in Martin's blog:
http://harizanov.com/2013/05/interfacing-with-paradox-home-security-system (http://harizanov.com/2013/05/interfacing-with-paradox-home-security-system)
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: tomat5 on Aug 22, 2013, 02:48 pm
Hi
I have SP6000 Paradox.  I use the babyware software and I have  a simple usb-ttl converter to communicate.

Byte 8: zone status. If==0 zone is closed  if==1 zone is opened
Byte 9: zone number
Byte 10: partition of the current zone.
I made a program, and I can see the status of the zones on PC. I tryed to monitor the serial port to know what the other bytes mean, but it's difficult. I would like to manage all the functions of the system. Arm, disarm, alarm, troubles atc....
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Sep 01, 2013, 12:02 am
An update:
Byte 1: unknown
Bytes from 2 to 3: year
Byte 4: month
Byte 5: day
Byte 6: hour
Byte 7: minutes
Byte 8: zone status. If==0 zone is closed  if==1 zone is opened
Byte 9: zone number
Byte 10: partition of the current zone
Bytes from 16 to 31: zone's name
...
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: skirchev on Oct 06, 2013, 03:38 pm
Hello, I am playing with Spectra 1738 panel. Connected the serial port to my Debian server using RS232 to USB converter. The boud rate I am using is 9600. But can see only 7 bytes sent when an event is triggered. It seems the bytes differ from the ones Mauzer described.
Here is a sample of what I am dumping:
(the first value is the time i inserted - not from the Paradox system)
1381052775      11      5b      b0      8       1       5b      b0
1381052775      11      5b      b0      8       11      5b      b0
1381052795      81      60      0       8       1       60      0
1381052795      81      60      0       8       11      60      0
1381052799      41      60      0       8       1       60      0
1381052799      41      60      0       8       11      60      0

It seems the 5th byte reports sensor state.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: japesanim on Jun 04, 2014, 02:19 pm
Just in case anyone is still looking for this, you can find the protocol doc for the Digiplex online. The file name is, "DIGIPLEX-ASCII-EP00-eng.pdf". (Sans quotes.)

For example: http://www.elektro-mahl.cz/dokumenty/DIGIPLEX/DIGIPLEX-ASCII-EP00-eng.pdf

You need to have the PRT3 module in, and configured to, "Home Automation," mode. Hope this helps. :)
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jun 19, 2014, 06:51 pm
An update:
Byte 1: packet beginning??
Bytes from 2 to 3: year
Byte 4: month
Byte 5: day
Byte 6: hour
Byte 7: minutes
Byte 8: zone status. If==0 zone is closed  if==1 zone is opened
Byte 9: zone number
Byte 10: partition of the current zone
Bytes from 16 to 31: zone's name
...
Byte 37: 1 byte checksum
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Budvar10 on Jun 20, 2014, 01:27 pm
Which kind of Spectra, 1738?
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jun 20, 2014, 01:42 pm
SP7000
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Mauzer on Jul 29, 2014, 09:06 pm
found  :)
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: SimonSayz on Nov 11, 2014, 03:39 am
Hi,

I also own a Spectra 1738. I want to interfacing with it using arduino.

The data here is very usefull for my project: Monitoring my house :)
For now, i have temperature, humidity, sound detection, flood warning, etc... But nothing from my alarm system... Everything can be accessed by web.

My biggest problem is that I cant find which pin is what on the serial ouput port? can you tell me which pin is Tx, gnd and VCC?

I tried to find the ground of the board but couldn't find it... I'm pretty new to electronic and without a known ground, it's hard to find the pin used for ground.

Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: tomat5 on Nov 17, 2014, 09:43 am
This is the pinout of the paradox serial connector.:(https://www.google.hu/search?q=paradox+serial+adapter&biw=1366&bih=653&source=lnms&tbm=isch&sa=X&ei=fbNpVLLEI-LdywOimYLYCQ&ved=0CAYQ_AUoAQ#facrc=_&imgdii=_&imgrc=XQeQNWZuQbDr7M%253A%3BJ9uNY3pOZ1y2qM%3Bhttp%253A%252F%252Fwww.hobbielektronika.hu%252Fforum%252Fgetfile.php%253Fid%253D141561%3Bhttp%253A%252F%252Fwww.hobbielektronika.hu%252Fforum%252Findex.php%253Fsf%253D*%252Btopic%25253A17%2526h%253Dh%2526pg%253D18%3B175%3B174)
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: SimonSayz on Mar 06, 2015, 12:59 am
Hi,

Topic revival!!
I've been able to get data from my Spectra 1738. But the Paradox Serial Protocol posted here isn't the same as on my spectra 1738.

Note that the spectra 1738 doesn't have a year or a date, just a time.

Here's the bytes i get when i open and close the door.

Open and close the door 6 times at 17h47.
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_

Open and close the door 5 times at 17h48.
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>

If you isolate remove the DD, you get the same bytes but in at weird order...
<97><FE><00><AF><E9><00> This is opening door at 17h47.
<E9><00><AF><97><FE><00> And this is closing door at 17h47.

Few questions comes up.
What is that DD byte... is the last bytes a checksum, so 07 and the last 00 could be checksum ?

Any of you have been able to translate the bytes you get from the spectrsa 1738 ?

Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: SimonSayz on Mar 06, 2015, 02:22 am
In my research prior to connect to my spectra. I documented the way to connect to the system.

Attached to the reply, the pinout of the serial ouput, the max232 connections and the inside of the Paradox USB307.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Budvar10 on Mar 06, 2015, 08:53 am
Hi,
very interesting research. I am the owner of Spectra 1738 but have no USB307. If I will use something like circuit on the second picture could I connect it directly to Rx, Tx and GND pins for communication with? Is the purpose of AUX pin power for the connected device? Which connector did you mean, directly on the 1738 board which is for service keyboard? Does it use 5V logic not 12V? And let me say serial settings.

Thanks.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: SimonSayz on Mar 06, 2015, 03:54 pm
Hi Budvar,

The serial connector is labeled serial ouput. It's not the memory key or the keyboard connector.

The USB307, it doesn't do a lot for the price :)
It has two important things a max232 chip and a ftdi chip.

If you do as pictured in the second picture, you'll be able to see the bytes from the serial output. Use a ttl to usb cable and your computer will be able to use terminal, screen, minicom or any other terminal communication tool...
I'll use the computer until a understand the protocol and will transfer the serial communication and analysis to the arduino.

And yes, you don't use the power from the serial output, use the 5V from the usb cable. On the serial output connector, the pin you will use is tx, rx and gnd.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: SimonSayz on Mar 06, 2015, 04:29 pm
i made a few mistakes in my first protocol analysis... I wanted to go too fast :)
The _ is valid. It represent something as any other bytes.

Open and close door 6 times at 17h47 and 5 times at 17h48
1      2       3      4       5      6       7      1        2      3      4       5       6      7
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
17h48
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>

Open and close door 5 times at 20h53 and 4 times at 20h54
 
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
20h54
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>

Open and close door 4 times at 21h00 and 4 times at 21h01

_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
21h01
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>

Open and close door at 21h03 and 21h04

_<F7><F9><00><AF><AF><06><DD><AF><06><AF><F7><F9><00>
_<F7><F9><00><AF><AF><06><DD><AF><06><AF><F7><F9><00>
21h04
_<F7><F9><01><AF><AF><01><DD><AF><01><AF><F7><F9><01>
_<F7><F9><01><AF><AF><01><DD><AF><01><AF><F7><F9><01>
Open and close ANOTHER door at 21h04
_   {     <F9><01><AF><AF><01><BD><AF><01><AF><F7><F9><01>
_   {     <F9><01><AF><AF><01><BD><AF><01><AF><F7><F9><01>

I never tried to decode something... But i'm trying.
The first and the second set of 7 bytes aren't in the same order...
first set:
byte 6 could be hour.
byte 7 could be minute.

Second set:
byte 1 could be SensorID(door 1, door 2)
byte 2 could be hour
byte 3 could be minute

It's a good challenge isn't ? :)
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: SimonSayz on Mar 06, 2015, 04:50 pm
One thing i noted.
Ascii table goes to 127... 7F in hexa... But the firsts characters in the ascii table couldn't be represented with a character.
That's why we see characters like _, {, etc etc... And this is also why 01, 06, 00 is shown even if it's in the ascii table...

So if i see a _, that means the byte was 5F...
See ascii table.

So... if i see AF, F9 or AF for example, it's because it doesn't have any ascii representation...

My terminal is trying to resolve the byte in ascii... if it can't, it shows the byte value.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Budvar10 on Mar 08, 2015, 04:25 pm
Thanks SimonSayz. I will try it soon.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: ldjohn on May 08, 2015, 09:43 pm
hey there, not sure if it helps, but i have this code running in python on a raspberry pi.. connected to my prt3 interface.
In this code there is a fair amount of information about the decoded bytes etc and what they mean.
Here is the URL on GITHUB: https://github.com/cb22 - look in paradox2
I see the guy has also got some info on the CASA project..

Regards
John
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: gerasalus on Jul 18, 2016, 10:37 pm
So i have a Paradox SP550. I've hooked up Arduino pro mini to Paradox serial  port (used only rx and tx,  (Arduino is powered via usb).

Event seems to be 37 bytes, but for some reason, each byte in the event is 0xFF (or 255). Any hints on why could this be happening?

Code: [Select]

#include <SoftwareSerial.h>
 
SoftwareSerial paradoxSerial(8,7);

void setup() {
    Serial.begin(9600);
    paradoxSerial.begin(9600);
    paradoxSerial.flush();
}
 
void loop()
{
  if(paradoxSerial.available()) {
     int data = paradoxSerial.read();
     Serial.println(data);
    }
}
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: tvigouroux on Oct 26, 2017, 03:21 pm
Hi,

So far I have seen (https://github.com/gytisgreitai/paradox-security-arduino) good advance understanding the messages and events.

I am looking for ways to interact with my sp4000 board, as the IP150 does (arm and disarm mainly). This weekend I going to try to sniff the packets that commands this modes in babyware in order to figure out if it is possible to replicate trough an custom app without Paradox IP modules.

Any experience relative to this would be appreciated.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: jphenning on Jan 15, 2018, 12:15 pm
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: tiagoaveiro on Jan 18, 2018, 08:17 pm
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.
Hi, I have interest.

How do you prefere to send me?
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: jconner on Jan 27, 2018, 10:46 am
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.
Hi
I'm also interested in these if you could PM me a copy too.
Thanks
JC
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: jako264 on Feb 25, 2018, 07:39 pm
Heloo,

Well where are we about communicate with the panel.

The event is super easy to decode.... Yes when something is triggered i take perfecr 37 byte decode it.

For example if a zone "change state" the triger will fire and the serial will send a 37 byte information.

BUT, when i first connect how can i ASK for the status of all the zones?

I do not want to arm disarm, for security reasons, but i want to use the info states with openhab.

Please anyone did achive this?

I have all the info about the communication protocol but is far away for me :)

Let's figure this out....

Waiting for brainstorming and to provide any data that i allready find.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: jphenning on Mar 01, 2018, 02:39 pm
It depends on which Paradox panel you're using.  I can help with the EVO48 & EVO192,  but not Spectra/Magellan.  For the EVO this sits in RAM.  I'm assuming this is similar for the Spectra/Magellan but I dont have a memory map of those panels.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: samoa on Mar 17, 2018, 03:56 pm
Hi,
I am also interested in it.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Dimitroff on May 01, 2018, 06:51 pm
I'm interested with this task too but you must know something. For succesfull decoding you must use only one model with same firmware version. In example Evo192 with firmwate version 4.63 and Evo192 with firmware version 6.86 aren't the same. So knowing the Paradox protocol is not enough.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: warriorsmen on Sep 19, 2018, 12:53 pm
hi there am i able to connect with a USB to Serial Cable TTL 4 Pin RS 232 UART to the paradox alarm system and use WinLoad or BabyWare??
thjis is the usb device i purchased https://www.trademe.co.nz/Browse/Listing.aspx?id=1771244404
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: jphenning on Nov 01, 2018, 08:39 am
I cant see why not.  The Paradox alarms work with 5V logic, and it seems this USB device you purchased can operate on 5V.  Just confirm this with any technical info you received.  You dont want to feed your USB serial device 5V when it can only handle 3.3V.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: Munzee on Jan 01, 2019, 03:32 pm
I have a Paradox MG5050, I am trying to communicate with the alarm panel using the Serial connector but without any luck. Can someone please assist.

I am using the Uno. My hardware connection is as follows: RX on serial connector to pin 8 on Uno, TX on serial connector to pin 7 on Uno. The Uno is powered via PC USB.

Attached is the code which I'm using (basically to test if my software serial connection is up and running):

#include <SoftwareSerial.h>

SoftwareSerial mySerial(7,8); //Rx ; Tx

void setup() {
  Serial.begin(9600);
  mySerial.begin(9600);
  mySerial.flush();
  Serial.println("start");
}

void loop() {
    if (mySerial.available()){
    Serial.println("mySerial available");
    }

}


Using the IDE serial monitor set to the same baud rate, the only message I get is
"start" which is for the usb serial connection. All else is blank as though mySerial doesn't become available.

What am I doing wrong?
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: montyx on Feb 10, 2020, 10:46 pm
Hello!

I have an EVO192 panel, with a keypad, and a magnetic door sensor on my desk.
I'd like to connect and read the serial communication from the panel with my Ubuntu PC with the help of an FTDI device:
FTDI UART to USB (https://www.aliexpress.com/item/32817470068.html)
Can you help me how can I read, what the panel send? I tried to use minicom, but there isn't any signal sent through serial, when I open or close the door sensor.
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: quayhudoithuong on Feb 24, 2020, 04:53 am
thank you
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: kkdjc on Mar 13, 2020, 10:15 am
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.
Hi, I have the EVO192 and am definitely interested in the docs. Could you please PM me? Regards
Title: Re: Interfacing with Paradox Spectra Security Systems
Post by: ferdie on Jul 15, 2020, 03:32 pm
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.
Do you still have the documents? Can you please send it to me.