Differences

This shows you the differences between two versions of the page.

--- projects:xiaomi-flora [2016/10/31 20:13] – emeryth
+++ projects:xiaomi-flora [2020/02/12 16:16] (current) – emeryth
@@ Line 1: / Line 1: @@
-====== Xiaomi Flora Flower Monitor teardown and analysis ======
+{{template>:template:project
+ | name=xiaomi-flora
+ | status=completed
+ | founder=[[user>emeryth]]
+ | repo=
+}}
+====== Xiaomi Flora Plant Monitor teardown and analysis ======
 by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl)
 This is a teardown and analysis of the Xiaomi flower/plant monitor (it doesn't seem to have an official name).
-It is not extremely in-depth because the main goal was to figure out how to use the device without the official app.
+The analysis is not extremely in-depth because the main goal was to figure out how to use the device without the official app.
+**Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https://community.home-assistant.io/t/xiaomi-mi-plants-monitor-flower/3388 ) but everything here is my independent work.
 ===== What is it =====
@@ Line 17: / Line 26: @@
   * Soil moisture
   * Soil fertility (via electrical conductivity)
+===== Hardware =====
+The device is sealed well, with lots of gaskets and even manually applied conformal coating on chips.
+The plastic shell is fused together, so you must use a knife to take it apart.
+==== Scans of the PCB: ====
+{{:projects:flora_front.jpg?direct&300|}}
+{{:projects:flora_back.jpg?direct&300|}}
+==== Pin header ====
+|2 ???|4 SW_CLK|5 SWDIO|8 GND|
+|1 VBATT|3 ???|6 ???|7 GND|
+==== Chips on the PCB ====
+  * U1 - Dialog Semiconductor DA14580 SoC with BLE http://www.dialog-semiconductor.com/products/connectivity/bluetooth-low-energy/smartbond-da14580
+  * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors
+  * U5 - Unknown SON8 chip marked "5F1 A61 J1G 1", could be EEPROM/flash
+{{:projects:guvcview_image-5.jpg?direct&300|DA14580}}
+{{:projects:guvcview_image-7.jpg?direct&300|U5 chip}}
+==== Sensors ====
+The light and temperature sensors are placed on the top of the device.
+{{:projects:sensors.jpg?direct&600|}}
+The legs end with metal studs that are used to measure soil fertility via electrical conductance.
+Hidden inside the legs are two traces that end in plates, probably a capacitive method to measure soil moisture.
+{{:projects:plates.jpg?direct&600|}}
+===== Getting data out of the device =====
+The device uses BLE GATT for communication, but the sensor values are not immediately available.
+When the original app connects to the device, it performs an elaborate initialization, but I have found out most of it isn't required.
+Available handles:
+**0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version
+**0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading
+**0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros
+Example data frame, values are little-endian
+^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^
+| Temperature || ?? | Light intensity |||| Moisture | Fertility ||  ?? | ?? | ?? | ?? | ?? | ?? |
+Notes:
+  * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C
+  * Light intensity in lux, not sure if 32-bit
+  * Moisture in percent
+  * Fertility in µS/cm
+**0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications
+Here is a short Python script to get all the interesting data from the device:
+<code>
+#Read data from Xiaomi flower monitor, tested on firmware version 2.6.6
+from gattlib import GATTRequester, GATTResponse
+from struct import *
+address = "DE:AD:BE:EF:CA:FE"
+requester = GATTRequester(address)
+#Read battery and firmware version attribute
+data=requester.read_by_handle(0x0038)[0]
+battery, version = unpack('<B6s',data)
+print "Battery level:",battery,"%"
+print "Firmware version:",version
+#Enable real-time data reading
+requester.write_by_handle(0x0033, str(bytearray([0xa0, 0x1f])))
+#Read plant data
+data=requester.read_by_handle(0x0035)[0]
+temperature, sunlight, moisture, fertility = unpack('<hxIBHxxxxxx',data)
+print "Light intensity:",sunlight,"lux"
+print "Temperature:",temperature/10.,"°C"
+print "Soil moisture:",moisture,"%"
+print "Soil fertility:",fertility,"uS/cm"
+</code>
+==== Historical data ====
+The device stores historical data when not connected that can be later synchronized.
+I have not figured it out yet, but looking at the dumps it seems to work by writing an address to handle 0x003e and the reading data from handle 0x003c.
+===== Firmware hacking =====
+I have no interest in changing the firmware, since you can already get all data you need from the original firmware.
+But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect to the cpu using OpenOCD.