Difference between revisions of "VINDRIKTNING"

From RevSpace
Jump to navigation Jump to search
(Software)
 
(36 intermediate revisions by the same user not shown)
Line 3: Line 3:
 
  |Picture=VINDRIKTNING.png
 
  |Picture=VINDRIKTNING.png
 
  |Omschrijving=Hacking IKEA VINDRIKTNING PM2.5 indicator
 
  |Omschrijving=Hacking IKEA VINDRIKTNING PM2.5 indicator
  |Status=In progress
+
  |Status=Completed
 
  |Contact=bertrik
 
  |Contact=bertrik
 
}}
 
}}
Line 9: Line 9:
 
== What ==
 
== What ==
 
This page is about hacking the IKEA [https://www.ikea.com/nl/nl/p/vindriktning-luchtkwaliteitsensor-70498242/ VINDRIKTNING] PM2.5 indicator light.
 
This page is about hacking the IKEA [https://www.ikea.com/nl/nl/p/vindriktning-luchtkwaliteitsensor-70498242/ VINDRIKTNING] PM2.5 indicator light.
 +
 +
I have removed the original microcontroller and installed an ESP8266 to talk to the particulate matter (PM) sensor, control the LEDs and the fan.
 +
The software on the ESP8266 allows me to interactively send commands to the PM sensor.
 +
 +
Another approach is to leave in the original microcontroller and add an ESP8266 to just snoop the commands exchanged between the original microcontroller and the PM sensor.
 +
This is perhaps more useful if you just want to use the indicator light as a sensor in your home automation setup.
 +
More information can be found there: https://esphome.io/components/sensor/pm1006.html
  
 
== Hardware ==
 
== Hardware ==
* power is by USB-C probably 5V
+
* power is by USB-C 5V
 
* the particulate matter sensor is the PM1006, probably very similar to the [https://en.gassensor.com.cn/ParticulateMatterSensor/info_itemid_105.html Cubic PM1006K] but with a slightly different command set
 
* the particulate matter sensor is the PM1006, probably very similar to the [https://en.gassensor.com.cn/ParticulateMatterSensor/info_itemid_105.html Cubic PM1006K] but with a slightly different command set
 
* has LEDs for three colours (red, orange and green)
 
* has LEDs for three colours (red, orange and green)
* has a light level sesnro
+
* has a light level sensor
 
* the sensor output can be PWM or UART, the UART output provides a PM2.5 value
 
* the sensor output can be PWM or UART, the UART output provides a PM2.5 value
  
Line 22: Line 29:
 
* there is an internal header with signals LED_G_1, PWM_Fan, LED_R_1, FAN-, FAN+
 
* there is an internal header with signals LED_G_1, PWM_Fan, LED_R_1, FAN-, FAN+
 
* there is a separate header for the fan with signals FAN+,FAN-
 
* there is a separate header for the fan with signals FAN+,FAN-
* there is an 8-pin IC, could this be the "main" microcontroller?
+
* there is an 8-pin IC, which is the microcontroller, an ES7P001
 
* there is a light-sensing element, that controls the brightness of the LED
 
* there is a light-sensing element, that controls the brightness of the LED
 +
 +
With no PM1006 attached at all, the sensor indicates "green", or good air quality!
  
 
More pictures of its internals, with reverse-engineered schematics:
 
More pictures of its internals, with reverse-engineered schematics:
 
https://threadreaderapp.com/thread/1415291684569632768.html
 
https://threadreaderapp.com/thread/1415291684569632768.html
  
[https://pbs.twimg.com/media/E6QmjekX0AIG_WL.jpg VINDRIKTNING Schematic] by Adam Hořčica
+
[https://pbs.twimg.com/media/E6QmjekX0AIG_WL.jpg VINDRIKTNING Schematic] by Adam Hořčica<br>
 +
<b>NOTE: the schematic appears to swap pin 2 and 4 which connect the GND and +5V!!!</b>
  
 
=== Interfacing with ESP8266 ===
 
=== Interfacing with ESP8266 ===
The datasheet of the PM1006K mentions that it takes 5V as power and communicates using 4.5V levels.
+
The datasheet of the PM1006 mentions that it takes 5V as power and communicates using 4.5V levels.
 
The reverse-engineered schematic shows resistors in line with the RX and TX lines.
 
The reverse-engineered schematic shows resistors in line with the RX and TX lines.
An ESP8266 should be 5V tolerant. This means that it is probably possible to directly connect an ESP8266 in place of the original microcontroller.
+
An ESP8266 should be 5V tolerant [https://www.ridiculously-simple.com/2021/05/19/are-the-esp32-and-esp8266-5v-tolerant-yes-they-officially-are/ (link)]. This means that it is possible to directly connect an ESP8266 in place of the original microcontroller.
 +
The series resistor limit the current from the PM1006 TX line into the ESP8266 RX line.
  
 
== Hacking ==
 
== Hacking ==
The microcontroller is an ES7P001.
+
What I've done is remove the existing microcontroller entirely (hot air gun) and replace it with an ESP8266 that reads out the raw PM value.
 
+
This means I've soldered wires to internal test pads and attached them to a Wemos D1 mini board.  
Find out if it can be read out, perhaps reprogram it.
 
  
Idea: by default, the light only shows one quality indicator, but the particulate matter sensor datasheet shows that it can output PM1.0, PM2.5 and PM10 values too. You could fit an ESP8266 that reads out the raw PM categories and publish them over WiFi, e.g. using a home assistant compatible protocol.
+
Mapping of the internal pads to the wemos D1 mini:
 +
* Wemos D1 mini D2 -> PM1006 RX = "ISPDA" pad
 +
* Wemos D1 mini D1 -> PM1006 TX = "RESET" pad
 +
* Wemos D1 mini A0 -> VINDRIKTNING LDR = "LED_R1" pad
 +
* Wemos D1 mini D0 -> VINDRIKTNING FAN control = "PWM_FAN" pad
 +
* Wemos D1 mini D5 -> VINDRIKTNING green LED = LED_G1" pad
 +
* Wemos D1 mini D3 -> VINDRIKTNING red/orange LED = "ISPCLK" pad
  
With no PM1006K attached at all, the sensor indicates "green", or good air quality!
+
Unfortunately, the ESP8266 output voltage is not enough to light the orange LED.
 +
It can only control the red LEDs and the green LEDs.
  
 
=== Protocol ===
 
=== Protocol ===
 
Mentioned [https://threadreaderapp.com/thread/1415291684569632768.html here], the MCU sends
 
Mentioned [https://threadreaderapp.com/thread/1415291684569632768.html here], the MCU sends
 
   11 02 0B 01 E1
 
   11 02 0B 01 E1
This is different from the command mentioned in the data sheet!
+
This is different from the command mentioned in the PM1006K data sheet!
 +
 
 +
Command:
 +
* 1 byte: 0x11
 +
* 1 byte: length N of command data
 +
* N bytes:command data
 +
* 1 byte: check sum
 +
 
 +
Response:
 +
* 1 byte: 0x16
 +
* 1 byte: length N of response data
 +
* N bytes: response data
 +
* 1 byte: check sum
 +
 
 +
The first byte of the command data is the command code.
 +
The first byte of the response data echoes back the same command code.
 +
 
 +
Someone told me:
 +
* The PM1006K "PM" command results in the same PM2.5 value as the PM1006 "PM2.5" command, the PM1.0 and PM10 values will be 0 in the response
 +
 
 +
=== Experimentation ===
 +
Using the 'c' command in the .ino file, you can experiment with different commands:
 +
It appears that at least the following commands return data:
 +
* [0x01] undocumented?
 +
* [0x02] command mentioned in the PM1006K datasheet, returns array of PM-values, but only PM2.5 is filled
 +
* [0x0B 0x01] command mentioned in the PM1003 datasheet, used in the original firmware
 +
 
 +
For example:
 +
<pre>
 +
>m
 +
Measuring... PM2.5 = 33
 +
OK
 +
>c 01
 +
CMD: 01
 +
RSP: 01 00 00 03 A7 00 00 03 AA 00 00 00 22
 +
OK
 +
</pre>
 +
Obviously the 0x22 in the end is the PM2.5 concentration (34 ug/m3).
 +
But what about the other numbers, 0x3A7 and 0x3AA?
 +
 
 +
<pre>
 +
>c 02
 +
CMD: 02
 +
RSP: 02 00 00 00 22 00 00 00 00 00 00 00 00
 +
OK
 +
</pre>
 +
This command just returns the PM2.5 (0x22 = 34 ug/m3)
 +
 
 +
</pre>
 +
<pre>
 +
>c 0b01
 +
CMD: 0B 01
 +
RSP: 0B 00 00 00 22 00 00 03 A7 00 00 00 2D 02 00 00 0C
 +
OK
 +
</pre>
 +
Again the PM2.5, again the 0x3A7 number that is also present in the 01 response.
 +
What about the 2D and 02 and 0C bytes?
 +
 
 +
Perhaps the 0x2D number is a kind of estimate for PM10, it seems to be correlated to PM2.5, but always higher in value.
 +
The 0x3A7 (935 in decimal) could be some kind of timing parameter, e.g. equivalent number of milliseconds high or low time.
 +
The 0x0C value is always the same.
 +
 
 +
I wonder if perhaps this thing also has a "secret" temperature sensor that can be read.
 +
The datasheet (PM1006_LED_PARTICLE_SENSOR_MODULE_SPECIFICATIONS.pdf) mentions: "Integrated temperature sensor, temperature compensation within the whole temperature range".
 +
However I could not see any value in any of the responses that seems to correlate with temperature.
  
 
== Software ==
 
== Software ==
Some intial, untested code for an ESP8266 (Wemos D1 mini) to communicate with the PM1006 sensor inside this device can be found at
+
Code for an ESP8266 (Wemos D1 mini) to communicate with the PM1006 sensor inside this device can be found at
 
https://github.com/bertrik/pm1006
 
https://github.com/bertrik/pm1006
 
The hardware probably needs a level shifter in line with the RX and TX signals.
 

Latest revision as of 13:10, 28 July 2022

Project VINDRIKTNING
VINDRIKTNING.png
Hacking IKEA VINDRIKTNING PM2.5 indicator
Status Completed
Contact bertrik
Last Update 2022-07-28

What

This page is about hacking the IKEA VINDRIKTNING PM2.5 indicator light.

I have removed the original microcontroller and installed an ESP8266 to talk to the particulate matter (PM) sensor, control the LEDs and the fan. The software on the ESP8266 allows me to interactively send commands to the PM sensor.

Another approach is to leave in the original microcontroller and add an ESP8266 to just snoop the commands exchanged between the original microcontroller and the PM sensor. This is perhaps more useful if you just want to use the indicator light as a sensor in your home automation setup. More information can be found there: https://esphome.io/components/sensor/pm1006.html

Hardware

  • power is by USB-C 5V
  • the particulate matter sensor is the PM1006, probably very similar to the Cubic PM1006K but with a slightly different command set
  • has LEDs for three colours (red, orange and green)
  • has a light level sensor
  • the sensor output can be PWM or UART, the UART output provides a PM2.5 value

Pictures of its internals: https://twitter.com/guido_burger/status/1413900622919872521

  • there is a footprint for a kind of debug header, with signals ISPDA, RESET, ISPCLK, GND, +5V
  • there is an internal header with signals LED_G_1, PWM_Fan, LED_R_1, FAN-, FAN+
  • there is a separate header for the fan with signals FAN+,FAN-
  • there is an 8-pin IC, which is the microcontroller, an ES7P001
  • there is a light-sensing element, that controls the brightness of the LED

With no PM1006 attached at all, the sensor indicates "green", or good air quality!

More pictures of its internals, with reverse-engineered schematics: https://threadreaderapp.com/thread/1415291684569632768.html

VINDRIKTNING Schematic by Adam Hořčica
NOTE: the schematic appears to swap pin 2 and 4 which connect the GND and +5V!!!

Interfacing with ESP8266

The datasheet of the PM1006 mentions that it takes 5V as power and communicates using 4.5V levels. The reverse-engineered schematic shows resistors in line with the RX and TX lines. An ESP8266 should be 5V tolerant (link). This means that it is possible to directly connect an ESP8266 in place of the original microcontroller. The series resistor limit the current from the PM1006 TX line into the ESP8266 RX line.

Hacking

What I've done is remove the existing microcontroller entirely (hot air gun) and replace it with an ESP8266 that reads out the raw PM value. This means I've soldered wires to internal test pads and attached them to a Wemos D1 mini board.

Mapping of the internal pads to the wemos D1 mini:

  • Wemos D1 mini D2 -> PM1006 RX = "ISPDA" pad
  • Wemos D1 mini D1 -> PM1006 TX = "RESET" pad
  • Wemos D1 mini A0 -> VINDRIKTNING LDR = "LED_R1" pad
  • Wemos D1 mini D0 -> VINDRIKTNING FAN control = "PWM_FAN" pad
  • Wemos D1 mini D5 -> VINDRIKTNING green LED = LED_G1" pad
  • Wemos D1 mini D3 -> VINDRIKTNING red/orange LED = "ISPCLK" pad

Unfortunately, the ESP8266 output voltage is not enough to light the orange LED. It can only control the red LEDs and the green LEDs.

Protocol

Mentioned here, the MCU sends

 11 02 0B 01 E1

This is different from the command mentioned in the PM1006K data sheet!

Command:

  • 1 byte: 0x11
  • 1 byte: length N of command data
  • N bytes:command data
  • 1 byte: check sum

Response:

  • 1 byte: 0x16
  • 1 byte: length N of response data
  • N bytes: response data
  • 1 byte: check sum

The first byte of the command data is the command code. The first byte of the response data echoes back the same command code.

Someone told me:

  • The PM1006K "PM" command results in the same PM2.5 value as the PM1006 "PM2.5" command, the PM1.0 and PM10 values will be 0 in the response

Experimentation

Using the 'c' command in the .ino file, you can experiment with different commands: It appears that at least the following commands return data:

  • [0x01] undocumented?
  • [0x02] command mentioned in the PM1006K datasheet, returns array of PM-values, but only PM2.5 is filled
  • [0x0B 0x01] command mentioned in the PM1003 datasheet, used in the original firmware

For example:

>m
Measuring... PM2.5 = 33
OK
>c 01
CMD: 01
RSP: 01 00 00 03 A7 00 00 03 AA 00 00 00 22
OK

Obviously the 0x22 in the end is the PM2.5 concentration (34 ug/m3). But what about the other numbers, 0x3A7 and 0x3AA?

>c 02
CMD: 02
RSP: 02 00 00 00 22 00 00 00 00 00 00 00 00
OK

This command just returns the PM2.5 (0x22 = 34 ug/m3)

>c 0b01
CMD: 0B 01
RSP: 0B 00 00 00 22 00 00 03 A7 00 00 00 2D 02 00 00 0C
OK

Again the PM2.5, again the 0x3A7 number that is also present in the 01 response. What about the 2D and 02 and 0C bytes?

Perhaps the 0x2D number is a kind of estimate for PM10, it seems to be correlated to PM2.5, but always higher in value. The 0x3A7 (935 in decimal) could be some kind of timing parameter, e.g. equivalent number of milliseconds high or low time. The 0x0C value is always the same.

I wonder if perhaps this thing also has a "secret" temperature sensor that can be read. The datasheet (PM1006_LED_PARTICLE_SENSOR_MODULE_SPECIFICATIONS.pdf) mentions: "Integrated temperature sensor, temperature compensation within the whole temperature range". However I could not see any value in any of the responses that seems to correlate with temperature.

Software

Code for an ESP8266 (Wemos D1 mini) to communicate with the PM1006 sensor inside this device can be found at https://github.com/bertrik/pm1006