Hacking an Air Purifier: 🤔 How to approach triggering button pushes on its PCB? - Page 1
Forum section: electronics / beginners

author: dinos
author_rank: Newbie
timestamp: April 01, 2023, 06:35:35 pm
content: Hi Everyone,I'm a software engineer with little to no knowledge of electronics... maybe someone can help me how to (generally) approach the following:Living in the city, I bought threeair purifiersabout a month ago to get rid of dust (these changed my freakn' life tbh).Model:Winix Zero S(Europe)For US Americans, theWinix AM80seems to be the equivalent.These air purifiers are dumb (not IoT connected), so my idea is tosolder an ESP32 or RaspberryPi Pico to the PCB(four buttons) to connect them via a RaspberryPi HomeBridge to my existing Apple HomeKit network to remote control / automate them.Where I'm atI took one of them apart and retrieved the PCB (see pictures). But since I can't doCtrl+Zin the real world, I'm super anxious on how to figure out where / how to attach the basic electronics without breaking it. What also throws me off is, that my voltage meter shows in concurrency mode that pressing a button interrupts the circuit and does not close it 😮 (so the button press pulls it low?). So naively attaching wires to the leads and close them electronically wouldn't work...My goal is to keep all original functionality; meaning the original buttons etc should keep working. In the long term I'd like to open source it, potentially create a custom pcb, so people can add a form of "mod-chip" to the device to make it IoT.Seeking AdviceI'm interested how you experienced guys would approach this? And in particular, what general steps I could do with my existing equipment.General Voltage Meter, max 500V, 500mA FuseMini 4ch Oscilloscope,Miniware DS213(never used it yet)Bread-Board, Resistors, Cables, Soldering Iron, Flux, Raspberry Pi, ESP32 etc.I am thankful for any tips, links etc as I lack the general thought process.When I was younger I used to solder mod chips onto xboxes; but getting to the point of integrating with existing electronics — without try and error 🔥 — really throws off 😵‍💫

author: mariush
author_rank: Super Contributor
timestamp: April 01, 2023, 07:07:02 pm
content: You have to draw the schematic. It's not hard, just a lot of back and forth between front and back.The IC1 is just a plain standard ULN2003A clone, basically 7 transistors in a package... when some input comes in, the output that belongs with that input is connected to ground, so the led turns on or offTR x are plain standard transistors, D are generic diodes, maybe 1n400x or something equivalent...top 3 contacts of CN1 go to first 3 inputs of IC1, next 3 inputs of IC1 are connected to contacts 2-5 of that middle connector.last pin of that middle connector is voltage, as you have the electrolytic surface mount capacitor between voltage and groundand so on and you keep tracing and reverse engineer the circuit and see what happens and people here will give you more advice one you post the reverse engineered schematic

author: dinos
author_rank: Newbie
timestamp: April 01, 2023, 07:12:46 pm
content: Quote from: mariush on April 01, 2023, 07:07:02 pmThank you @mariush, please read my question again:QuoteIf I'd tell my beginner computer science ml students to "just take some integrals of the reduced latent space to isolate the anomalies from the variational auto encoder and so on" I'd get a 0 out of 10 teacher rating.Thank you for your time, but your reply doesn't answer my question for advice.

author: mariush
author_rank: Super Contributor
timestamp: April 01, 2023, 08:00:45 pm
content: You need to draw the schematic to figure out how the buttons work.. with all the vias and transistors it's hard to tell what happens. There may be vias from the other side of the board coming out UNDER the buttons, and I / we can't see that in the pictures.There's at least two ways buttons can work ...1. there's some voltage on one pin of the button, and the other pin is connected to ground - when you press the button, the pins are connected and there voltage is pulled down to ground, and the microcontroller or whatever is at the other end detects this drop in voltage and does something.2. there's voltage on a pin and the other pin is connected to microcontroller or something - when you press button, voltage goes through the button and into the microcontroller or whatever and therefore microcontroller "sees" a digital 1 on that pin and does something.another example ... there may be 2 input/output wires from a microcontroller and you can have two buttons and two diodes ... the microcontroller can constantly set one pin to input, the other to output , then flip the first to output and second to input and check to see what button is pressed.pin ---- [ <-- diode ] [ button 1] ---- pinpin ---- [ diode ---> ] [ button 2] ---- pinwhen you push button 1, the controller will detect button is pressed only when left pin is input and right pin is output.it's possible the transistors there have something to do with the buttons, so you need to know what happens.As for how you would interact, it could be something as simple as having your controller measure the voltage on some wires ... if there's 3.3v or 5v or whatever, you know user presses the button or the button is not pressed.You could use optocouplers ... when there's energy in the circuit to light up the leds, you could have some of that flow through your optocoupler and this way you'd detect something's going on.once you draw the schematic you will also know what each wire in the connector does, so you could for example make a small adapter cable that sits between the plug of that device and the connector on the pcb and acts like a man in the middle intercepting the signals and forwarding them or changing them.You may not have to make a cable, it may be enough to just solder wires in various places (like on the resistors going to that ULN2003A clone)

author: dinos
author_rank: Newbie
timestamp: April 01, 2023, 08:06:17 pm
content: Thank you mariush, that gives me a much better idea — especially regarding the behavior. Alright…. phew. That means I have to learn how to reverse engineer / draw schematics from an existing board. I remember watching a few yt videos back then, where all of them pretty much destroyed the board in the process which would be a problem. I’ll do some research tomorrow. Thank you

author: sokoloff
author_rank: Super Contributor
timestamp: April 01, 2023, 08:24:54 pm
content: I'd probably tackle the buttons again. Among the four pads, there are usually two pairs that are connected and pressing the button connects across them.If you're not going to be insanely heartbroken if something breaks, I'd probably take a 100 ohm resistor and quickly connect it diagonally across a button and see if that registers as a button press. If it doesn't, I'd then try a 47 ohm or 22 ohm same way. That's not terribly likely to harm anything and might get you a very quick confirmation that you will be able to control the device's button states. If you want to be a little safer, a 1000 ohm to start is probably safer, but if it does nothing your next step is a 470R or 100R anyway, so I often just skip right to the lower value part.This is not the safest possible way to investigate the device's function. It probably is about the fastest, though.

author: dobsonr741
author_rank: Frequent Contributor
timestamp: April 01, 2023, 08:26:11 pm
content: If the buttons are hard to crack, or they multiplexed just apply an optocoupler. If you want to go that way we can give you recommendations.As far as sw goes, you might have already found HomeSapn on GitHub.

author: dinos
author_rank: Newbie
timestamp: April 02, 2023, 10:54:54 am
content: Thank you everyone. Researching a lot.I went ahead and took high resolution images with my DLSR and overlayed them (see below). To me it looks like that this is a simple two layer pcb, so that the fear of a i.e. a hidden via under the button (that @mariush mentioned) can be ruled out (?) Currently I am researching if I can get a replacement board from Winix... since if I break this I have to buy a whole new machine 💸.Safely trying things as @skoloff mentioned, seems to be the logical next step though...I'll keep you posted.Excalidraw Whiteboard:https://link.excalidraw.com/readonly/A35v6NCBiUWuKw3M8RUj

author: dinos
author_rank: Newbie
timestamp: April 02, 2023, 04:59:48 pm
content: A friend told me to take the thing completely apart, to see if there is a "motherboard". Thought... "right, a computer inside of a fan" 🙄Well, apparently, there are computers in everything 🤦🏻‍♂️. Here is the main board. Looks like the IC on the button PCB can be "man in the middled", since the state of the device is completely tracked outside of the button pcb. AkaButton PCB <-> Electronics with ESP32 <-> MainboardThat would mean no soldering on the original device; just plug a board in the middle 🙏

author: dobsonr741
author_rank: Frequent Contributor
timestamp: April 02, 2023, 10:11:43 pm
content: I suggest focus on the button board. Two parts to come up with:1. What buttons you want to control and what status LEDs you want to expose to HomeKit? Is there anything else you want to monitor other than those?2. The full schematics of the button board. Beside tracing/drawing, you can measure with an ohmmeter if not sure or when a resistor value is needed.One you have both, next is to design a wiretap board to operate switches/get statuses. You can make tradeoffs this time, if you happen to find yourself in a difficult position.

author: mariush
author_rank: Super Contributor
timestamp: April 03, 2023, 07:55:08 am
content: You have some useful information in the last pictures.The last picture tells you that the trace on the edge of the board on the top right corner is GROUND ... so the 4th pin in the 4 pin Key header is GROUND, the 6th pin in the 6 pin Indicator header is GROUNDYou have a thicker trace that goes to pin 4 (center pin) of the 7 pin header, and that same voltage trace also goes to pin 1 of the 6 pin Indicator header.On the 7 pin header, there's resistors on 3 of the traces, 540 ohm, seems like regular current limiting resistors to me. The other 3 traces don't have current limiting resistors but they may be on the other board.It is a bit confusing because the headers have 7 , 6 and 4 pins, but the other board it's 8, 7 and 4 pins ... so one wire is either doubled, or coming from some other header, no idea... don't have pictures of the cables.But basically at least the leds you could manipulate by just sending voltage on the 6 pins in the led header. If you don't want to have voltage going to the controller, you could just make a cable and have diodes with very low voltage drop block any voltage going back towards that controller.Or, have your own controller take in the signals from that controller and either propagate them to a header or override them with yours.In the indicator header, it looks like the 3 pins go directly to the uln2003a so again, you could put your controller easily between header and cable.If I were to guess, maybe the 7th pin in that CN1 header goes to the missing component on the pcb labeled GAS. Maybe in the air purifiers with this feature, the wire connected to this 7th pin goes to the header titled ODOR on your power supply board (also not populated in your unit)On the Key header , R12 and R14 could be pull up resistors, as first pin in header seems to be voltage, middle pins seem to go to buttons, then last pin is ground ... there's 2 resistors again to limit current and traces go directly into the controller.So somehow the controller using just these 2 wires can determine which of the 4 buttons are pushed, if I were go guess, probably alternating between making one of the middle pins input and the other output and the other way around.