Reverse Engineering Honeywell 345 MHz Home Automation Sensors with an RTL-SDR
OpenHAB is an open source home automation software program which is designed to interface and manage all the various sensors and systems in an automated house. One problem however, is that many wireless sensors and actuators utilize a proprietary communications protocol that is not supported by OpenHAB.
In his home, Dan Englender had several Honeywell 5800 series 345 MHz wireless security door sensors, all of which interface using a proprietary protocol that is not yet implemented in OpenHAB. In order to get around this, Dan decided to reverse engineer the protocol and implement a decoder into OpenHAB himself.
Dan’s four part write up covers the RF capture & demodulation, protocol reverse engineering and implementation into OpenHAB. First he looked up the frequency and bandwidth of the signal via the FCC filing information on fcc.io. Then he captured some packets from a door sensor using his RTL-SDR and GNU Radio, and then wrote a short Python program to decode the protocol and transmit the door open/closed information to OpenHAB. In the future he hopes to optimize the decoder so that it can comfortably run on a Raspberry Pi as the GNU Radio script uses quite a bit of computing power.
The final project is called decode345 and the code is available over on his GitHub.
Oh yeah, i agree with you! Thanks to you, my friend and I came up with a great idea for our garage project. How well we took a break, and successfully looked at the forum. Although we have nothing to do now, we are waiting for a courier in any case. We ordered parts from automation-usa.com for our project. True, the courier has been driving for a long time, in theory he should have been with us as early as an hour ago. Strange, maybe he got stuck in a traffic jam, the main thing is that the order comes in one piece. Thank you very much again! You really helped me a lot with my friend!
Good article, even in 2021!
I have a box with some sort of alarm in it I was hoping for some help finding what it is it says rf-ror-345 inside it says csi rf-ror rev06
I attempted a similar project to listen to Honeywell Sensors with an RPi, RTL-SDR, and GRC, but could not resolve range issues. Adjusting “Ch0 Gain Mode” did not increase range beyond about 30′, or 15′ reliably.
So I attempted CC1101 route. I burned quite a few CC1101s connected over SPI, so worked on other projects for a while. I may try a USB dongle like CC1111EMK868-915 or a YARD Stick One.
oh wow. this is awesome Dan! I have a bunch of 2gig sensors came with the house when we bought it but I do not have an active plan (the previous owner used vivint). I assume I can use similar approach to make my own home security system.
If you make it all the way to Part 4 of the write-up, you find I did end up optimizing it enough to run comfortably on a Pi (by writing a C decoder instead of the previous python one). But you can skip the write-up and find both the C and python decoders in the repository.
For what it’s worth: rtl_433 demodulates and decodes both Honeywell and DSC security sensors. Over 60 wireless device protocols are currently decoded covering temperature/humidity sensors, weather stations, simple RF remotes etc. While some of the decoders could be considered a work in progress, many are robust enough to be useful for a number of home automation tasks.
The code is on github