Interfacing with Paradox Spectra Security Systems

[skirchev]

Hello, I am playing with Spectra 1738 panel. Connected the serial port to my Debian server using RS232 to USB converter. The boud rate I am using is 9600. But can see only 7 bytes sent when an event is triggered. It seems the bytes differ from the ones Mauzer described.
Here is a sample of what I am dumping:
(the first value is the time i inserted - not from the Paradox system)
1381052775      11      5b      b0      8       1       5b      b0
1381052775      11      5b      b0      8       11      5b      b0
1381052795      81      60      0       8       1       60      0
1381052795      81      60      0       8       11      60      0
1381052799      41      60      0       8       1       60      0
1381052799      41      60      0       8       11      60      0

It seems the 5th byte reports sensor state.

[japesanim]

Just in case anyone is still looking for this, you can find the protocol doc for the Digiplex online. The file name is, "DIGIPLEX-ASCII-EP00-eng.pdf". (Sans quotes.)

For example: http://www.elektro-mahl.cz/dokumenty/DIGIPLEX/DIGIPLEX-ASCII-EP00-eng.pdf

You need to have the PRT3 module in, and configured to, "Home Automation," mode. Hope this helps.

[Mauzer]

An update:
Byte 1: packet beginning??
Bytes from 2 to 3: year
Byte 4: month
Byte 5: day
Byte 6: hour
Byte 7: minutes
Byte 8: zone status. If==0 zone is closed  if==1 zone is opened
Byte 9: zone number
Byte 10: partition of the current zone
Bytes from 16 to 31: zone's name
...
Byte 37: 1 byte checksum

[Budvar10]

Which kind of Spectra, 1738?

[Mauzer]

SP7000

[Mauzer]

found 

[SimonSayz]

Hi,

I also own a Spectra 1738. I want to interfacing with it using arduino.

The data here is very usefull for my project: Monitoring my house
For now, i have temperature, humidity, sound detection, flood warning, etc... But nothing from my alarm system... Everything can be accessed by web.

My biggest problem is that I cant find which pin is what on the serial ouput port? can you tell me which pin is Tx, gnd and VCC?

I tried to find the ground of the board but couldn't find it... I'm pretty new to electronic and without a known ground, it's hard to find the pin used for ground.

[tomat5]

This is the pinout of the paradox serial connector.:

[SimonSayz]

Hi,

Topic revival!!
I've been able to get data from my Spectra 1738. But the Paradox Serial Protocol posted here isn't the same as on my spectra 1738.

Note that the spectra 1738 doesn't have a year or a date, just a time.

Here's the bytes i get when i open and close the door.

Open and close the door 6 times at 17h47.
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_
<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>_

Open and close the door 5 times at 17h48.
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>_
<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>

If you isolate remove the DD, you get the same bytes but in at weird order...
<97><FE><00><AF><E9><00> This is opening door at 17h47.
<E9><00><AF><97><FE><00> And this is closing door at 17h47.

Few questions comes up.
What is that DD byte... is the last bytes a checksum, so 07 and the last 00 could be checksum ?

Any of you have been able to translate the bytes you get from the spectrsa 1738 ?

[SimonSayz]

In my research prior to connect to my spectra. I documented the way to connect to the system.

Attached to the reply, the pinout of the serial ouput, the max232 connections and the inside of the Paradox USB307.

[Budvar10]

Hi,
very interesting research. I am the owner of Spectra 1738 but have no USB307. If I will use something like circuit on the second picture could I connect it directly to Rx, Tx and GND pins for communication with? Is the purpose of AUX pin power for the connected device? Which connector did you mean, directly on the 1738 board which is for service keyboard? Does it use 5V logic not 12V? And let me say serial settings.

Thanks.

[SimonSayz]

Hi Budvar,

The serial connector is labeled serial ouput. It's not the memory key or the keyboard connector.

The USB307, it doesn't do a lot for the price
It has two important things a max232 chip and a ftdi chip.

If you do as pictured in the second picture, you'll be able to see the bytes from the serial output. Use a ttl to usb cable and your computer will be able to use terminal, screen, minicom or any other terminal communication tool...
I'll use the computer until a understand the protocol and will transfer the serial communication and analysis to the arduino.

And yes, you don't use the power from the serial output, use the 5V from the usb cable. On the serial output connector, the pin you will use is tx, rx and gnd.

[SimonSayz]

i made a few mistakes in my first protocol analysis... I wanted to go too fast
The _ is valid. It represent something as any other bytes.

Open and close door 6 times at 17h47 and 5 times at 17h48
1      2       3      4       5      6       7      1        2      3      4       5       6      7
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
_<97><FE><00><AF><E9><00><DD><E9><00><AF><97><FE><00>
17h48
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>
_<97><BE><00><AF><E9><07><DD><E9><07><AF><97><BE><00>

Open and close door 5 times at 20h53 and 4 times at 20h54
 
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
_<97><F9><01><AF><B9><05><DD><B9><05><AF><97><F9><01>
20h54
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>
_<97><F9><02><AF><B9><02><DD><B9><02><AF><97><F9><02>

Open and close door 4 times at 21h00 and 4 times at 21h01

_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
_<F7><F9><00><AF><AF><00><DD><AF><00><AF><F7><F9><00>
21h01
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>
_<F7><F9><00><AF><AF><07><DD><AF><07><AF><F7><F9><00>

Open and close door at 21h03 and 21h04

_<F7><F9><00><AF><AF><06><DD><AF><06><AF><F7><F9><00>
_<F7><F9><00><AF><AF><06><DD><AF><06><AF><F7><F9><00>
21h04
_<F7><F9><01><AF><AF><01><DD><AF><01><AF><F7><F9><01>
_<F7><F9><01><AF><AF><01><DD><AF><01><AF><F7><F9><01>
Open and close ANOTHER door at 21h04
_   {     <F9><01><AF><AF><01><BD><AF><01><AF><F7><F9><01>
_   {     <F9><01><AF><AF><01><BD><AF><01><AF><F7><F9><01>

I never tried to decode something... But i'm trying.
The first and the second set of 7 bytes aren't in the same order...
first set:
byte 6 could be hour.
byte 7 could be minute.

Second set:
byte 1 could be SensorID(door 1, door 2)
byte 2 could be hour
byte 3 could be minute

It's a good challenge isn't ?

[SimonSayz]

One thing i noted.
Ascii table goes to 127... 7F in hexa... But the firsts characters in the ascii table couldn't be represented with a character.
That's why we see characters like _, {, etc etc... And this is also why 01, 06, 00 is shown even if it's in the ascii table...

So if i see a _, that means the byte was 5F...
See ascii table.

So... if i see AF, F9 or AF for example, it's because it doesn't have any ascii representation...

My terminal is trying to resolve the byte in ascii... if it can't, it shows the byte value.

[Budvar10]

Thanks SimonSayz. I will try it soon.