VINDRIKTNING

Project VINDRIKTNING
Hacking IKEA VINDRIKTNING PM2.5 indicator
Status	Completed
Contact	bertrik
Last Update	2022-07-28

What

This page is about hacking the IKEA VINDRIKTNING PM2.5 indicator light.

I have removed the original microcontroller and installed an ESP8266 to talk to the particulate matter (PM) sensor, control the LEDs and the fan. The software on the ESP8266 allows me to interactively send commands to the PM sensor.

Another approach is to leave in the original microcontroller and add an ESP8266 to just snoop the commands exchanged between the original microcontroller and the PM sensor. This is perhaps more useful if you just want to use the indicator light as a sensor in your home automation setup. More information can be found there: https://esphome.io/components/sensor/pm1006.html

Hardware

• power is by USB-C 5V
• the particulate matter sensor is the PM1006, probably very similar to the Cubic PM1006K but with a slightly different command set
• has LEDs for three colours (red, orange and green)
• has a light level sensor
• the sensor output can be PWM or UART, the UART output provides a PM2.5 value

Pictures of its internals: https://twitter.com/guido_burger/status/1413900622919872521

• there is a footprint for a kind of debug header, with signals ISPDA, RESET, ISPCLK, GND, +5V
• there is an internal header with signals LED_G_1, PWM_Fan, LED_R_1, FAN-, FAN+
• there is a separate header for the fan with signals FAN+,FAN-
• there is an 8-pin IC, which is the microcontroller, an ES7P001
• there is a light-sensing element, that controls the brightness of the LED

With no PM1006 attached at all, the sensor indicates "green", or good air quality!

More pictures of its internals, with reverse-engineered schematics: https://threadreaderapp.com/thread/1415291684569632768.html

VINDRIKTNING Schematic by Adam Hořčica
NOTE: the schematic appears to swap pin 2 and 4 which connect the GND and +5V!!!

Interfacing with ESP8266

The datasheet of the PM1006 mentions that it takes 5V as power and communicates using 4.5V levels. The reverse-engineered schematic shows resistors in line with the RX and TX lines. An ESP8266 should be 5V tolerant (link). This means that it is possible to directly connect an ESP8266 in place of the original microcontroller. The series resistor limit the current from the PM1006 TX line into the ESP8266 RX line.

Hacking

What I've done is remove the existing microcontroller entirely (hot air gun) and replace it with an ESP8266 that reads out the raw PM value. This means I've soldered wires to internal test pads and attached them to a Wemos D1 mini board.

Mapping of the internal pads to the wemos D1 mini:

• Wemos D1 mini D2 -> PM1006 RX = "ISPDA" pad
• Wemos D1 mini D1 -> PM1006 TX = "RESET" pad
• Wemos D1 mini A0 -> VINDRIKTNING LDR = "LED_R1" pad
• Wemos D1 mini D0 -> VINDRIKTNING FAN control = "PWM_FAN" pad
• Wemos D1 mini D5 -> VINDRIKTNING green LED = LED_G1" pad
• Wemos D1 mini D3 -> VINDRIKTNING red/orange LED = "ISPCLK" pad

Unfortunately, the ESP8266 output voltage is not enough to light the orange LED. It can only control the red LEDs and the green LEDs.

Protocol

Mentioned here, the MCU sends

 11 02 0B 01 E1

This is different from the command mentioned in the PM1006K data sheet!

Command:

• 1 byte: 0x11
• 1 byte: length N of command data
• N bytes:command data
• 1 byte: check sum

Response:

• 1 byte: 0x16
• 1 byte: length N of response data
• N bytes: response data
• 1 byte: check sum

The first byte of the command data is the command code. The first byte of the response data echoes back the same command code.

Someone told me:

• The PM1006K "PM" command results in the same PM2.5 value as the PM1006 "PM2.5" command, the PM1.0 and PM10 values will be 0 in the response

Experimentation

Using the 'c' command in the .ino file, you can experiment with different commands: It appears that at least the following commands return data:

• [0x01] undocumented?
• [0x02] command mentioned in the PM1006K datasheet, returns array of PM-values, but only PM2.5 is filled
• [0x0B 0x01] command mentioned in the PM1003 datasheet, used in the original firmware

For example:

>m
Measuring... PM2.5 = 33
OK
>c 01
CMD: 01
RSP: 01 00 00 03 A7 00 00 03 AA 00 00 00 22
OK

Obviously the 0x22 in the end is the PM2.5 concentration (34 ug/m3). But what about the other numbers, 0x3A7 and 0x3AA?

>c 02
CMD: 02
RSP: 02 00 00 00 22 00 00 00 00 00 00 00 00
OK

This command just returns the PM2.5 (0x22 = 34 ug/m3)

>c 0b01
CMD: 0B 01
RSP: 0B 00 00 00 22 00 00 03 A7 00 00 00 2D 02 00 00 0C
OK

Again the PM2.5, again the 0x3A7 number that is also present in the 01 response. What about the 2D and 02 and 0C bytes?

Perhaps the 0x2D number is a kind of estimate for PM10, it seems to be correlated to PM2.5, but always higher in value. The 0x3A7 (935 in decimal) could be some kind of timing parameter, e.g. equivalent number of milliseconds high or low time. The 0x0C value is always the same.

I wonder if perhaps this thing also has a "secret" temperature sensor that can be read. The datasheet (PM1006_LED_PARTICLE_SENSOR_MODULE_SPECIFICATIONS.pdf) mentions: "Integrated temperature sensor, temperature compensation within the whole temperature range". However I could not see any value in any of the responses that seems to correlate with temperature.

Software

Code for an ESP8266 (Wemos D1 mini) to communicate with the PM1006 sensor inside this device can be found at https://github.com/bertrik/pm1006