VINDRIKTNING

Project VINDRIKTNING
Hacking IKEA VINDRIKTNING PM2.5 indicator
Status	In progress
Contact	bertrik
Last Update	2022-03-05

What

This page is about hacking the IKEA VINDRIKTNING PM2.5 indicator light.

Hardware

• power is by USB-C 5V
• the particulate matter sensor is the PM1006, probably very similar to the Cubic PM1006K but with a slightly different command set
• has LEDs for three colours (red, orange and green)
• has a light level sensor
• the sensor output can be PWM or UART, the UART output provides a PM2.5 value

Pictures of its internals: https://twitter.com/guido_burger/status/1413900622919872521

• there is a footprint for a kind of debug header, with signals ISPDA, RESET, ISPCLK, GND, +5V
• there is an internal header with signals LED_G_1, PWM_Fan, LED_R_1, FAN-, FAN+
• there is a separate header for the fan with signals FAN+,FAN-
• there is an 8-pin IC, could this be the "main" microcontroller?
• there is a light-sensing element, that controls the brightness of the LED

More pictures of its internals, with reverse-engineered schematics: https://threadreaderapp.com/thread/1415291684569632768.html

VINDRIKTNING Schematic by Adam Hořčica
NOTE: the schematic appears to swap pin 2 and 4 which connect the GND and +5V!!!

Interfacing with ESP8266

The datasheet of the PM1006 mentions that it takes 5V as power and communicates using 4.5V levels. The reverse-engineered schematic shows resistors in line with the RX and TX lines. An ESP8266 should be 5V tolerant. This means that it is probably possible to directly connect an ESP8266 in place of the original microcontroller.

The series resistors limits the current from the PM1006 TX line into the ESP8266 RX line.

Hacking

The microcontroller is an ES7P001.

Idea: Fit an ESP8266 that reads out the raw PM value and publish it over WiFi, e.g. using a home assistant compatible protocol.

With no PM1006 attached at all, the sensor indicates "green", or good air quality!

What I've done:

• Remove the existing microcontroller entirely
• Solder wires to the internal test pads and attach a Wemos D1 mini, the serial line resistors currently in place can be of use to limit 5V/3.3V interface issues.

Pinout:

• Wemos D1 mini D2 -> PM1006 RX = "ISPDA" pad
• Wemos D1 mini D1 -> PM1006 TX = "RESET" pad
• Wemos D1 mini A0 -> VINDRIKTNING LDR = "LED_R1" pad
• Wemos D1 mini D0 -> VINDRIKTNING FAN control = "PWM_FAN" pad
• Wemos D1 mini D5 -> VINDRIKTNING green LED = LED_G1" pad
• Wemos D1 mini D3 -> VINDRIKTNING red/orange LED = "ISPCLK" pad

Unfortunately, the ESP8266 output voltage is not enough to light the orange LED. It can only control the red LEDs and the green LEDs.

Protocol

Mentioned here, the MCU sends

 11 02 0B 01 E1

This is different from the command mentioned in the PM1006K data sheet!

Command:

• 1 byte: 0x11
• 1 byte: length N of command data
• N bytes:command data
• 1 byte: check sum

Response:

• 1 byte: 0x16
• 1 byte: length N of response data
• N bytes: response data
• 1 byte: check sum

The first byte of the command data is the command code. The first byte of the response data echoes back the same command code.

Someone told me:

• The PM1006K "PM" command results in the same PM2.5 value as the PM1006 "PM2.5" command, the PM1.0 and PM10 values will be 0 in the response

Experimentation

Using the 'c' command in the .ino file, you can experiment with different commands: It appears that at least the following commands return data:

• [0x01] undocumented?
• [0x02] command mentioned in the PM1006 datasheet
• [0x0B 0x01] command mentioned in the PM1003 datasheet

For example:

>m
Measuring... PM2.5 = 33
OK
>c 01
CMD: 01
RSP: 01 00 00 03 A7 00 00 03 AA 00 00 00 22
OK
>c 02
CMD: 02
RSP: 02 00 00 00 22 00 00 00 00 00 00 00 00
OK
>c 0b01
CMD: 0B 01
RSP: 0B 00 00 00 22 00 00 03 A7 00 00 00 2D 02 00 00 0C
OK

You can see the 0x22 (34 ug/m3) in the end of the response to the 01 command and in the middle of the response to the 0b01 command. Also we can see a repeat of the value 0x03A7 in both the 01 response and the 0B01 response, the meaning is yet unknown.

Software

Code for an ESP8266 (Wemos D1 mini) to communicate with the PM1006 sensor inside this device can be found at https://github.com/bertrik/pm1006