User Tools

Site Tools


projects:xiaomi-flora

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
projects:xiaomi-flora [2016/10/31 16:16] emerythprojects:xiaomi-flora [2020/02/12 16:16] (current) emeryth
Line 1: Line 1:
-====== Xiaomi Flora Flower Monitor teardown and analysis ======+{{template>:template:project 
 + | name=xiaomi-flora 
 + | status=completed 
 + | founder=[[user>emeryth]] 
 + | repo= 
 +}} 
 + 
 +====== Xiaomi Flora Plant Monitor teardown and analysis ======
  
 by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl) by [[people:emeryth:start|emeryth]] (emeryth at hackerspace.pl)
  
 This is a teardown and analysis of the Xiaomi flower/plant monitor (it doesn't seem to have an official name). This is a teardown and analysis of the Xiaomi flower/plant monitor (it doesn't seem to have an official name).
-It is not extremely in-depth because the main goal was to figure out how to use the device without the official app.+The analysis is not extremely in-depth because the main goal was to figure out how to use the device without the official app
 + 
 +**Note:** While writing this down, I have found out that I am not the first to publish something about the device ( https://community.home-assistant.io/t/xiaomi-mi-plants-monitor-flower/3388 ) but everything here is my independent work. 
 + 
 +===== What is it ===== 
 + 
 +{{:projects:flora.jpg?direct&300|}} 
 + 
 +Xiaomi Flora is a Bluetooth Low Energy device that monitors the environment of a plant. 
 + 
 +It measures: 
 +  * Sunlight intensity 
 +  * Air temperature 
 +  * Soil moisture 
 +  * Soil fertility (via electrical conductivity) 
 + 
 +===== Hardware ===== 
 + 
 +The device is sealed well, with lots of gaskets and even manually applied conformal coating on chips. 
 +The plastic shell is fused together, so you must use a knife to take it apart. 
 + 
 +==== Scans of the PCB: ==== 
 +{{:projects:flora_front.jpg?direct&300|}} 
 +{{:projects:flora_back.jpg?direct&300|}} 
 + 
 +==== Pin header ==== 
 + 
 +|2 ???|4 SW_CLK|5 SWDIO|8 GND| 
 +|1 VBATT|3 ???|6 ???|7 GND| 
 + 
 +==== Chips on the PCB ==== 
 + 
 +  * U1 - Dialog Semiconductor DA14580 SoC with BLE http://www.dialog-semiconductor.com/products/connectivity/bluetooth-low-energy/smartbond-da14580 
 +  * U2 - Unknown SOT353 chip, probably some kind of op-amp or other analog thing for the sensors 
 +  * U5 - Unknown SON8 chip marked "5F1 A61 J1G 1", could be EEPROM/flash 
 + 
 + 
 +{{:projects:guvcview_image-5.jpg?direct&300|DA14580}} 
 +{{:projects:guvcview_image-7.jpg?direct&300|U5 chip}} 
 + 
 +==== Sensors ==== 
 + 
 +The light and temperature sensors are placed on the top of the device. 
 + 
 +{{:projects:sensors.jpg?direct&600|}} 
 + 
 +The legs end with metal studs that are used to measure soil fertility via electrical conductance. 
 +Hidden inside the legs are two traces that end in plates, probably a capacitive method to measure soil moisture. 
 + 
 +{{:projects:plates.jpg?direct&600|}} 
 + 
 +===== Getting data out of the device ===== 
 + 
 +The device uses BLE GATT for communication, but the sensor values are not immediately available. 
 +When the original app connects to the device, it performs an elaborate initialization, but I have found out most of it isn't required. 
 + 
 +Available handles: 
 + 
 +**0x0038** - Reading returns 7 bytes - 1 byte battery level and 6 ASCII chars of firmware version 
 + 
 +**0x0033** - You need to write **0xA01F** to this handle to enable real-time data reading 
 + 
 +**0x0035** - The actual data from the sensors, can be read only after you enable real-time data, otherwise returns zeros 
 + 
 +Example data frame, values are little-endian 
 + 
 +^f7^00^10^13^00^00^00^25^f5^04^02^1c^40^fb^34^9b^ 
 +| Temperature || ?? | Light intensity |||| Moisture | Fertility ||  ?? | ?? | ?? | ?? | ?? | ?? | 
 + 
 +Notes: 
 +  * Temperature is signed 16-bit value in tenths of degrees C, so 265 means 26.5 °C 
 +  * Light intensity in lux, not sure if 32-bit 
 +  * Moisture in percent 
 +  * Fertility in µS/cm 
 + 
 +**0x0036** - writing **0x0100** to this handle will subscribe you to sensor value notifications 
 + 
 + 
 +Here is a short Python script to get all the interesting data from the device: 
 + 
 +<code> 
 +#Read data from Xiaomi flower monitor, tested on firmware version 2.6.6  
 + 
 +from gattlib import GATTRequester, GATTResponse 
 +from struct import * 
 + 
 +address = "DE:AD:BE:EF:CA:FE" 
 +requester = GATTRequester(address) 
 +#Read battery and firmware version attribute 
 +data=requester.read_by_handle(0x0038)[0] 
 +battery, version = unpack('<B6s',data) 
 +print "Battery level:",battery,"%" 
 +print "Firmware version:",version 
 +#Enable real-time data reading 
 +requester.write_by_handle(0x0033, str(bytearray([0xa0, 0x1f]))) 
 +#Read plant data 
 +data=requester.read_by_handle(0x0035)[0] 
 +temperature, sunlight, moisture, fertility = unpack('<hxIBHxxxxxx',data) 
 +print "Light intensity:",sunlight,"lux" 
 +print "Temperature:",temperature/10.,"°C" 
 +print "Soil moisture:",moisture,"%" 
 +print "Soil fertility:",fertility,"uS/cm" 
 +</code> 
 + 
 +==== Historical data ==== 
 + 
 +The device stores historical data when not connected that can be later synchronized. 
 + 
 +I have not figured it out yet, but looking at the dumps it seems to work by writing an address to handle 0x003e and the reading data from handle 0x003c. 
 + 
 + 
 +===== Firmware hacking ===== 
 + 
 +I have no interest in changing the firmware, since you can already get all data you need from the original firmware.
  
 +But if you really want to know, the device supports OTA firmware update and there is a header with SWD on the PCB, although I was unable to connect to the cpu using OpenOCD.
  
  
projects/xiaomi-flora.1477930617.txt.gz · Last modified: 2016/10/31 16:16 by emeryth

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki