76 lines
5.8 KiB
Markdown
76 lines
5.8 KiB
Markdown
Title: Hacking my Air Purifier into Home Assistant
|
|
Date: 2026-05-27
|
|
Category: Writing
|
|
Summary: Hardware hacking my Airmega 200M Purifier into Home Assistant.
|
|
Image: purifier1.jpg
|
|
Wide: true
|
|
|
|
My Airmega 200M air purifier has four speed settings: useless, less useless, annoying and SCREAMING BANSHEE. I was able to connect an ESP8266 Arduino to the motor driver board and get direct fine-grained control of the speed over Wifi. I use this to modulate the speed based on my distance to the air purifier so I don't have to listen to it.
|
|
|
|
![[purifier1.jpg]]
|
|
|
|
## Home Automation
|
|
|
|
I use motion sensors to control the lights in my house, so my home automation system somewhat has an idea of what room I'm in. I use this data to control the purifier's speed based on how far away I am from it. If I'm on the same floor, it runs very quietly (~12% power). If I'm one floor away, it runs at 50%. If I'm two floors away (or I'm not home), it runs at 100%.
|
|
|
|
I live alone, but my automation system has a "Guest Mode" which prevents motion from turning lights off. If this is enabled, the purifier only runs quietly.
|
|
|
|
## Technical Details
|
|
|
|
The power supply and motor driver board originally connect to the control board via a 6-pin ribbon cable. Pin 4 of that cable expects a PWM signal that controls the speed of the purifier's blower motor proportional to the duty cycle. Pins 1 and 5 happen to be 5 V and Ground, which are used to power the Wemos D1 Mini ESP8266.
|
|
|
|
The Wemos boots up and connects to an MQTT broker on my Wifi network. It subscribes to the `iot/purifier/mega_1234/speed` topic where `1234` is part of the MAC address so different purifiers on the network can be addressed easily. It listens to messages that are numbers 0-100 and maps the linearly to 60-140 which correspond to the PWM duty cycle range that the motor driver expects. You can find the [source code](https://git.tannercollin.com/tanner/airmega-hack/src/branch/master/firmware/firmware.ino) on my Gitea.
|
|
|
|
A side effect of this is that the control board is completely dead and manual control of the purifier no longer works except for unplugging it. I actually don't mind this because it also kills the blue LEDs and I just use my smart watch or phone to control it instead. The built-in dust sensor also no longer works, but it should be possible to also read this with the Arduino over serial.
|
|
|
|
## Hardware Hacking
|
|
|
|
Hacking the purifier is actually fairly straightforward. My purifier was already over a year old, so I didn't care about voiding my warranty. The power supply isn't isolated and the electronics' ground is floating at something like 48 VAC (learnt this the hard way), so I keep it unplugged while I'm modifying it.
|
|
|
|
I removed the cover and all the filters, and then the nine Philips screws holding the case together. I lifted the blower half up and propped it up at an angle. You can see a photo of it below, with the ribbon cable plugged into the control board at the bottom left:
|
|
|
|
![[purifier2.jpg]]
|
|
|
|
I didn't want to destroy the cable by cutting it to connect it to the Arduino, so I ordered some connectors off of Digikey. Both [2057-25SH-B-06-TR-ND](https://www.digikey.ca/short/mt9d2cm0) and [1175-51125-06-0200-01-ND](https://www.digikey.ca/short/v53bnq97) mate well with the white ribbon cable connector. I soldered the connector to a bit of 0.1" perf board and wired it to the Arduino:
|
|
|
|
![[purifier3.jpg]]
|
|
![[purifier4.jpg]]
|
|
|
|
The wiring is:
|
|
|
|
```
|
|
Wemos Cable
|
|
5V - Pin 1 (white)
|
|
G - Pin 5
|
|
D1 - Pin 4
|
|
```
|
|
|
|
I then simply unplugged the control board, plugged in my perf board connector, and secured it with some of the tape inside the purifier as you can see in the first photo. I reassembled the case and reinstalled the filters.
|
|
|
|
## Research
|
|
|
|
Researching the hack was not as straightforward. I disassembled the unit and noticed the blower motor was wired to the same board where the power supply was. I then saw the ribbon cable between that board and the control board, so chose to target it first. The pins were labelled on the board's silkscreen and I soldered some jumper cables to the back so I could scope them easier.
|
|
|
|
![[purifier5.jpg]]
|
|
|
|
I attached my oscilloscope's ground lead to the `GND_S` pin and probe to the `SIG1` pin, expecting that to be a signal. I plugged the purifier in and immediately heard a POP! That's when I learned the power supply isn't isolated and I had just shorted 48 volts through my oscilloscope to ground.
|
|
|
|
Luckily I only blew a fuse on the board and just had to solder a new one on, part number [4598-MST3.15A250VCT-ND](https://www.digikey.ca/short/nv9wtwr9). From then on I used two probes, one on the signal and one on the ground pin and used my oscilloscope's math feature to subtract them. This made a noisy and imprecise trace, but it was enough to tell the speed was controlled by PWM.
|
|
|
|
This showed me the hack was indeed possible, so I ordered a differential probe off Amazon in order to scope the signals precisely:
|
|
|
|
```
|
|
- black (GND_S) floats 48 VAC above mains ground
|
|
- green (CON3-3) is PWM 0-5 V, higher duty cycle for more speed
|
|
- blue (CON3-2) is speed tach. 50% duty cycle, period widens as it gets slower
|
|
- low speed 80 Hz
|
|
- medium speed 119 Hz
|
|
- high speed 200 Hz
|
|
- brown (SIG1) doesn't look like anything
|
|
- white (15VON/OFF) is 1.5 V when machine is off, noisy 5.3 V when running
|
|
- red (+5V_1A) is pretty clean 5.3 V always
|
|
```
|
|
|
|
I wrote a quick Arduino sketch to see if the 0-3.3 V PWM it outputs was enough to control the speed and it was. This, combined with the fact there's 5 V supplied by the ribbon cable meant that the Arduino could be connected simply with three wires, without the need for level shifters or a power supply.
|
|
|
|
I ordered 17 different 6-pin connectors with the same pitch off Digikey and tested each one until I was satisfied with the fit. I programmed the Arduino, soldered it all up, and the hack was complete! |