Interfacing with Paradox Spectra Security Systems

found :slight_smile:

Hi,

I also own a Spectra 1738. I want to interfacing with it using arduino.

The data here is very usefull for my project: Monitoring my house :slight_smile:
For now, i have temperature, humidity, sound detection, flood warning, etc... But nothing from my alarm system... Everything can be accessed by web.

My biggest problem is that I cant find which pin is what on the serial ouput port? can you tell me which pin is Tx, gnd and VCC?

I tried to find the ground of the board but couldn't find it... I'm pretty new to electronic and without a known ground, it's hard to find the pin used for ground.

This is the pinout of the paradox serial connector.:

Hi,

Topic revival!!
I've been able to get data from my Spectra 1738. But the Paradox Serial Protocol posted here isn't the same as on my spectra 1738.

Note that the spectra 1738 doesn't have a year or a date, just a time.

Here's the bytes i get when i open and close the door.

Open and close the door 6 times at 17h47.
<97><00><00>

<00><97><00>_
<97><00><00>
<00><97><00>_
<97><00><00>
<00><97><00>_
<97><00><00>
<00><97><00>_
<97><00><00>
<00><97><00>_
<97><00><00>
<00><97><00>_

Open and close the door 5 times at 17h48.
<97><00><07>

<07><97><00>_
<97><00><07>
<07><97><00>_
<97><00><07>
<07><97><00>_
<97><00><07>
<07><97><00>_
<97><00><07>
<07><97><00>

If you isolate remove the DD, you get the same bytes but in at weird order...
<97><00><00> This is opening door at 17h47.
<00><97><00> And this is closing door at 17h47.

Few questions comes up.
What is that DD byte... is the last bytes a checksum, so 07 and the last 00 could be checksum ?

Any of you have been able to translate the bytes you get from the spectrsa 1738 ?

In my research prior to connect to my spectra. I documented the way to connect to the system.

Attached to the reply, the pinout of the serial ouput, the max232 connections and the inside of the Paradox USB307.

unnamed.jpg

Hi,
very interesting research. I am the owner of Spectra 1738 but have no USB307. If I will use something like circuit on the second picture could I connect it directly to Rx, Tx and GND pins for communication with? Is the purpose of AUX pin power for the connected device? Which connector did you mean, directly on the 1738 board which is for service keyboard? Does it use 5V logic not 12V? And let me say serial settings.

Thanks.

Hi Budvar,

The serial connector is labeled serial ouput. It's not the memory key or the keyboard connector.

The USB307, it doesn't do a lot for the price :slight_smile:
It has two important things a max232 chip and a ftdi chip.

If you do as pictured in the second picture, you'll be able to see the bytes from the serial output. Use a ttl to usb cable and your computer will be able to use terminal, screen, minicom or any other terminal communication tool...
I'll use the computer until a understand the protocol and will transfer the serial communication and analysis to the arduino.

And yes, you don't use the power from the serial output, use the 5V from the usb cable. On the serial output connector, the pin you will use is tx, rx and gnd.

i made a few mistakes in my first protocol analysis... I wanted to go too fast :slight_smile:
The _ is valid. It represent something as any other bytes.

Open and close door 6 times at 17h47 and 5 times at 17h48
1 2 3 4 5 6 7 1 2 3 4 5 6 7
_<97><00><00>

<00><97><00>
_<97><00><00>
<00><97><00>
_<97><00><00>
<00><97><00>
_<97><00><00>
<00><97><00>
_<97><00><00>
<00><97><00>
_<97><00><00>
<00><97><00>
17h48
_<97><00><07>
<07><97><00>
_<97><00><07>
<07><97><00>
_<97><00><07>
<07><97><00>
_<97><00><07>
<07><97><00>
_<97><00><07>
<07><97><00>

Open and close door 5 times at 20h53 and 4 times at 20h54

_<97><01><05>

<05><97><01>
_<97><01><05>
<05><97><01>
_<97><01><05>
<05><97><01>
_<97><01><05>
<05><97><01>
_<97><01><05>
<05><97><01>
20h54
_<97><02><02>
<02><97><02>
_<97><02><02>
<02><97><02>
_<97><02><02>
<02><97><02>
_<97><02><02>
<02><97><02>

Open and close door 4 times at 21h00 and 4 times at 21h01

_<00><00>

<00><00>
_<00><00>
<00><00>
_<00><00>
<00><00>
_<00><00>
<00><00>
21h01
_<00><07>
<07><00>
_<00><07>
<07><00>
_<00><07>
<07><00>
_<00><07>
<07><00>

Open and close door at 21h03 and 21h04

_<00><06>

<06><00>
_<00><06>
<06><00>
21h04
_<01><01>
<01><01>
_<01><01>
<01><01>
Open and close ANOTHER door at 21h04
_ { <01><01><01><01>
_ { <01><01><01><01>

I never tried to decode something... But i'm trying.
The first and the second set of 7 bytes aren't in the same order...
first set:
byte 6 could be hour.
byte 7 could be minute.

Second set:
byte 1 could be SensorID(door 1, door 2)
byte 2 could be hour
byte 3 could be minute

It's a good challenge isn't ? :slight_smile:

One thing i noted.
Ascii table goes to 127... 7F in hexa... But the firsts characters in the ascii table couldn't be represented with a character.
That's why we see characters like _, {, etc etc... And this is also why 01, 06, 00 is shown even if it's in the ascii table...

So if i see a _, that means the byte was 5F...
See ascii table.

So... if i see AF, F9 or AF for example, it's because it doesn't have any ascii representation...

My terminal is trying to resolve the byte in ascii... if it can't, it shows the byte value.

Thanks SimonSayz. I will try it soon.

hey there, not sure if it helps, but i have this code running in python on a raspberry pi.. connected to my prt3 interface.
In this code there is a fair amount of information about the decoded bytes etc and what they mean.
Here is the URL on GITHUB: cb22 (Federico Lorenzi) · GitHub - look in paradox2
I see the guy has also got some info on the CASA project..

Regards
John

So i have a Paradox SP550. I've hooked up Arduino pro mini to Paradox serial port (used only rx and tx, (Arduino is powered via usb).

Event seems to be 37 bytes, but for some reason, each byte in the event is 0xFF (or 255). Any hints on why could this be happening?

#include <SoftwareSerial.h>
  
SoftwareSerial paradoxSerial(8,7);

void setup() {
    Serial.begin(9600);
    paradoxSerial.begin(9600);
    paradoxSerial.flush();
}
 
void loop()
{
  if(paradoxSerial.available()) {
     int data = paradoxSerial.read();
     Serial.println(data);
    } 
}

Hi,

So far I have seen good advance understanding the messages and events.

I am looking for ways to interact with my sp4000 board, as the IP150 does (arm and disarm mainly). This weekend I going to try to sniff the packets that commands this modes in babyware in order to figure out if it is possible to replicate trough an custom app without Paradox IP modules.

Any experience relative to this would be appreciated.

I have documents detailing the SP/MG and EVO serial connection if anyone is interested.

jphenning:
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.

Hi, I have interest.

How do you prefere to send me?

jphenning:
I have documents detailing the SP/MG and EVO serial connection if anyone is interested.

Hi
I'm also interested in these if you could PM me a copy too.
Thanks
JC

Heloo,

Well where are we about communicate with the panel.

The event is super easy to decode.... Yes when something is triggered i take perfecr 37 byte decode it.

For example if a zone "change state" the triger will fire and the serial will send a 37 byte information.

BUT, when i first connect how can i ASK for the status of all the zones?

I do not want to arm disarm, for security reasons, but i want to use the info states with openhab.

Please anyone did achive this?

I have all the info about the communication protocol but is far away for me :slight_smile:

Let's figure this out....

Waiting for brainstorming and to provide any data that i allready find.

It depends on which Paradox panel you're using. I can help with the EVO48 & EVO192, but not Spectra/Magellan. For the EVO this sits in RAM. I'm assuming this is similar for the Spectra/Magellan but I dont have a memory map of those panels.

Hi,
I am also interested in it.

I'm interested with this task too but you must know something. For succesfull decoding you must use only one model with same firmware version. In example Evo192 with firmwate version 4.63 and Evo192 with firmware version 6.86 aren't the same. So knowing the Paradox protocol is not enough.