Reverse Engineering Honeywell 345 MHz Home Automation Sensors with an RTL-SDR

OpenHAB is an open source home automation software program which is designed to interface and manage all the various sensors and systems in an automated house. One problem however, is that many wireless sensors and actuators utilize a proprietary communications protocol that is not supported by OpenHAB.

In his home, Dan Englender had several Honeywell 5800 series 345 MHz wireless security door sensors, all of which interface using a proprietary protocol that is not yet implemented in OpenHAB. In order to get around this, Dan decided to reverse engineer the protocol and implement a decoder into OpenHAB himself. 

Dan’s four part write up covers the RF capture & demodulation, protocol reverse engineering and implementation into OpenHAB. First he looked up the frequency and bandwidth of the signal via the FCC filing information on fcc.io. Then he captured some packets from a door sensor using his RTL-SDR and GNU Radio, and then wrote a short Python program to decode the protocol and transmit the door open/closed information to OpenHAB. In the future he hopes to optimize the decoder so that it can comfortably run on a Raspberry Pi as the GNU Radio script uses quite a bit of computing power.

The final project is called decode345 and the code is available over on his GitHub.

Honeywell 345 MHz Door Sensor
Honeywell 345 MHz Door Sensor
Custom Door Sensor Status in OpenHAB
Custom Door Sensor Status in OpenHAB

[Also seen on Hackaday]

 

4 comments

  1. Andy

    I attempted a similar project to listen to Honeywell Sensors with an RPi, RTL-SDR, and GRC, but could not resolve range issues. Adjusting “Ch0 Gain Mode” did not increase range beyond about 30′, or 15′ reliably.

    So I attempted CC1101 route. I burned quite a few CC1101s connected over SPI, so worked on other projects for a while. I may try a USB dongle like CC1111EMK868-915 or a YARD Stick One.

  2. moody

    oh wow. this is awesome Dan! I have a bunch of 2gig sensors came with the house when we bought it but I do not have an active plan (the previous owner used vivint). I assume I can use similar approach to make my own home security system.

  3. Dan Englender

    If you make it all the way to Part 4 of the write-up, you find I did end up optimizing it enough to run comfortably on a Pi (by writing a C decoder instead of the previous python one). But you can skip the write-up and find both the C and python decoders in the repository.

  4. Rob T.

    For what it’s worth: rtl_433 demodulates and decodes both Honeywell and DSC security sensors. Over 60 wireless device protocols are currently decoded covering temperature/humidity sensors, weather stations, simple RF remotes etc. While some of the decoders could be considered a work in progress, many are robust enough to be useful for a number of home automation tasks.

    The code is on github

Post a comment

You may use the following HTML:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.