projects:xiaomi-flora
Differences
This shows you the differences between two versions of the page.
Next revision | Previous revisionNext revisionBoth sides next revision | ||
projects:xiaomi-flora [2016/10/31 16:14] – created emeryth | projects:xiaomi-flora [2016/11/02 20:06] – [Xiaomi Flora Plant Monitor teardown and analysis] emeryth | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== Xiaomi Flora Flower | + | ====== Xiaomi Flora Plant Monitor teardown and analysis ====== |
+ | |||
+ | by [[people: | ||
+ | |||
+ | This is a teardown and analysis of the Xiaomi flower/ | ||
+ | The analysis is not extremely in-depth because the main goal was to figure out how to use the device without the official app. | ||
+ | |||
+ | **Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https:// | ||
+ | |||
+ | ===== What is it ===== | ||
+ | |||
+ | {{: | ||
+ | |||
+ | Xiaomi Flora is a Bluetooth Low Energy device that monitors the environment of a plant. | ||
+ | |||
+ | It measures: | ||
+ | * Sunlight intensity | ||
+ | * Air temperature | ||
+ | * Soil moisture | ||
+ | * Soil fertility (via electrical conductivity) | ||
+ | |||
+ | ===== Hardware ===== | ||
+ | |||
+ | The device is sealed well, with lots of gaskets and even manually applied conformal coating on chips. | ||
+ | The plastic shell is fused together, so you must use a knife to take it apart. | ||
+ | |||
+ | ==== Scans of the PCB: ==== | ||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | ==== Pin header ==== | ||
+ | |||
+ | |2 ???|4 SW_CLK|5 SWDIO|8 GND| | ||
+ | |1 VBATT|3 ???|6 ???|7 GND| | ||
+ | |||
+ | ==== Chips on the PCB ==== | ||
+ | |||
+ | * U1 - Dialog Semiconductor DA14580 SoC with BLE http:// | ||
+ | * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors | ||
+ | * U5 - Unknown SON8 chip marked "5F1 A61 J1G 1", could be EEPROM/ | ||
+ | |||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | ==== Sensors ==== | ||
+ | |||
+ | The light and temperature sensors are placed on the top of the device. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | The legs end with metal studs that are used to measure soil fertility via electrical conductance. | ||
+ | Hidden inside the legs are two traces that end in plates, probably a capacitive method to measure soil moisture. | ||
+ | |||
+ | {{: | ||
+ | |||
+ | ===== Getting data out of the device ===== | ||
+ | |||
+ | The device uses BLE GATT for communication, | ||
+ | When the original app connects to the device, it performs an elaborate initialization, | ||
+ | |||
+ | Available handles: | ||
+ | |||
+ | **0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version | ||
+ | |||
+ | **0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading | ||
+ | |||
+ | **0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros | ||
+ | |||
+ | Example data frame, values are little-endian | ||
+ | |||
+ | ^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^ | ||
+ | | Temperature || ?? | Light intensity |||| Moisture | Fertility || ?? | ?? | ?? | ?? | ?? | ?? | | ||
+ | |||
+ | Notes: | ||
+ | * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C | ||
+ | * Light intensity in lux, not sure if 32-bit | ||
+ | * Moisture in percent | ||
+ | * Fertility in µS/cm | ||
+ | |||
+ | **0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications | ||
+ | |||
+ | |||
+ | Here is a short Python script to get all the interesting data from the device: | ||
+ | |||
+ | < | ||
+ | #Read data from Xiaomi flower monitor, tested on firmware version 2.6.6 | ||
+ | |||
+ | from gattlib import GATTRequester, | ||
+ | from struct import * | ||
+ | |||
+ | address = " | ||
+ | requester = GATTRequester(address) | ||
+ | #Read battery and firmware version attribute | ||
+ | data=requester.read_by_handle(0x0038)[0] | ||
+ | battery, version = unpack('< | ||
+ | print " | ||
+ | print " | ||
+ | #Enable real-time data reading | ||
+ | requester.write_by_handle(0x0033, | ||
+ | #Read plant data | ||
+ | data=requester.read_by_handle(0x0035)[0] | ||
+ | temperature, | ||
+ | print "Light intensity:", | ||
+ | print " | ||
+ | print "Soil moisture:", | ||
+ | print "Soil fertility:", | ||
+ | </ | ||
+ | |||
+ | ===== Firmware hacking ===== | ||
+ | |||
+ | I have no interest in changing the firmware, since you can already get all data you need from the original firmware. | ||
+ | |||
+ | But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect with the cpu using OpenOCD. | ||
projects/xiaomi-flora.txt · Last modified: 2020/02/12 16:16 by emeryth