Apnea Board Forum - CPAP | Sleep Apnea
AirMini Travel Data Extraction & Teardown - Printable Version

+- Apnea Board Forum - CPAP | Sleep Apnea (https://www.apneaboard.com/forums)
+-- Forum: Public Area (https://www.apneaboard.com/forums/Forum-Public-Area)
+--- Forum: Software Support Forum (https://www.apneaboard.com/forums/Forum-Software-Support-Forum)
+--- Thread: AirMini Travel Data Extraction & Teardown (/Thread-AirMini-Travel-Data-Extraction-Teardown)

Pages: 1 2


AirMini Travel Data Extraction & Teardown - JimIve - 01-12-2019

I purchased an AirMini for a backup and for travel to my AirSense 10.  

There's a couple of problems with the AirMini Travel.  One is the noise!  (but a couple of 3D printed adapters and a muffler and I have that one reduced significantly, got 7.5 hours last night, usable finally, a better 3D printed muffler too is in the works to improve that further).

The other is no access to the fine grained patient data recorded without AirView, so, I did a teardown on mine, to see what can be done to access that data.   I resent paying over $1000 for a machine that won't give me access to my personal data I'm generating, but feels it acceptable to upload that to the cloud and use it for their own purposes whilst essentially compromising my own health by not letting me monitor the data myself without a DME. (rant over)

So... I opened it up with a view to getting at the data.  Getting in is fairly easy if anybody wants to do the same without
breaking / damaging it. Remove the filter to remove the 2 screws, then the grey plastic just pulls off.  At the other end (where it says "Airmini Autoset" on the darker gray plastic cap, a small flat screwdriver or supdger under the edge between the white rubber and the end of the cap will lever the clip to remove that cap, then there's another screw to remove.  

Once that's done the white rubber coated cover (the half with the buttons on), can be easily unclipped.  Getting at the other side of the circuit board can be done by pushing the black clip on the 3 wire FPC down 90 degrees and removing the FPC, then another screw and the PCB will lift up to access underneath (although there's nothing of note underneath apart from the Bluetooth Module)

** There are no anti tamper switches, machine works fine when reassembled ** 

A quick look at the PCB reveals:

10 pin (pogo type) header (I would assume is JTag)
STM32F469IG Arm Cortex M4 - 180MHz - 32bit, 1MByte Flash
IS25LP128 - 16MByte SPI Flash - ** Likely where the patient data is stored. **
MB85RS2MT 2MBit FRAM - (I would guess being used as RAM)
Blue Giga BT121-A Bluetooth Module
ispPAC-POWR605-01SN24I - Supervisor IC
VP233 / SN65HVD234 (deduced from the markings, but not confirmed) - CAN Bus Transceiver (near the power connection)..
From the size of the small 2 inner traces compared to the "power" outer traces, this suggests the power port will allow CAN Bus data transfer, i.e. it's not USB  

So potentially 4 ways to get at the data:
 1. Clip directly onto the flash (they've graciously included test pads on the pins which could be soldered to too)
 2. CAN Bus
 3. JTAG
 4. Tap into the Bluetooth Module

I didn't bother pulling disassembling the air box (as I'm just after my data), but if that interests you, everything can be unscrewed
from that point on.  The fan is a 3 phase brushless dc motor supplied by a DRV8302 (used for CPAPs)

If there's enough interest, I'll post my findings, teardown photos and data dumps.  "Theoretically" it shouldn't be too difficult to dump out the flash and start figuring out the data format, and then figure a mod pcb to extract data on a regular basis without having to teardown each time, or extract over CAN bus.

I will likely need some help from people familiar with the formats resmed use to store their data to reverse engineer the data format.  They may have just setup the flash as FAT, in which case it shouldn't be too difficult.

And obviously doing this will void your warranty and may impact your health and all the other disclaimers, although it comes apart and reassembles cleanly.

Lastly, can a moderator deny/confirm if treardown photos/data dumps would be permitted on this forum or not.


RE: AirMini Travel Data Extraction & Teardown - harre - 01-12-2019

I would like to see some pics Smile


RE: AirMini Travel Data Extraction & Teardown - JimIve - 01-12-2019

Sure, I'll just wait a day to see if a moderator objects or not.  I couldn't find anything in the rules or regulations, but I'd rather give them a chance than have it taken down.


RE: AirMini Travel Data Extraction & Teardown - Crimson Nape - 01-13-2019

While images are allowed, the server is very limited on storage space and bandwidth to serve graphics. Since your photos are sort of apnea related, I'd advise that you first send a request to the board's administrator, SuperSleeper (apneaboard@gmail.com).  You may wish to make the email's subject line something like, "CPAP Teardown Image Upload Request".  Please include make, model, the number of images and their size.  I'm sure this will be a determining factor.  

Ultimately, you can use off site image hosting from a site like imgur.  If you choose this avenue,  I would recommend creating a free account so the images will be located in a central location.  The only downside is if you erase an image on the host, it will be deleted from display here.

I hope this may be of help.


RE: AirMini Travel Data Extraction & Teardown - JimIve - 01-13-2019

Here are the photos:

[Image: lftSoP0.jpg]

[Image: rvNbitq.jpg]

[Image: Yn2ErnT.jpg]

[Image: WKQiywW.jpg]

[Image: 860CwL3.jpg]


RE: AirMini Travel Data Extraction & Teardown - SuperSleeper - 01-13-2019

Hi Jim, thanks for posting this.

I went ahead and put the images on the Apnea Board server so there won't be a problem if Imgur takes them down. I also optimized them for viewing on the forum, and then edited your posts to include the re-uploaded images on ApneaBoard.com.

The new file locations are:

https://www.apneaboard.com/images/lftSoP0.jpg

https://www.apneaboard.com/images/rvNbitq.jpg

https://www.apneaboard.com/images/Yn2ErnT.jpg

https://www.apneaboard.com/images/WKQiywW.jpg

https://www.apneaboard.com/images/860CwL3.jpg

Thanks


RE: AirMini Travel Data Extraction & Teardown - JimIve - 01-13-2019

Thanks SuperSleeper


RE: AirMini Travel Data Extraction & Teardown - JimIve - 02-27-2019

I’ve managed to download the 16MB SPI Flash(IS24LP128) and the 256KB FRAM in situ.  Pin 22 ( IN1_PWDRN) on the supervisor IC can be held low (test pad on reverse side of the board can be soldered to), to hold the STM32 processor in reset to allow in situ access to the flash and FRAM.  Also, “HOLD” on both chips needs to be held high to read anything.

So it would be possible to solder on a bluetooth daughter board to allow wireless download of those flash ICs, which I’m prepared to design and post if someone can figure out the file format.

The 256KB FRAM contains a FAT12 filesystem, but doesn't contain the sleep data (having some communication errors which need to be knocked down so I haven't seen every "page" on there yet, but it appears to be just settings and a journal file) and some DATALOG files (which don't contain sleep data), and the FRAM would be too small:

Code:
drwxrwxrwx  1 unknown  staff   1024  1 Jan  2012 DATALOG
drwxrwxrwx  1 unknown  staff   1024  1 Jan  2012 ERRORLOG
drwxrwxrwx  1 unknown  staff   1024  1 Jan  2012 SETTINGS
-rwxrwxrwx  1 unknown  staff  16384  1 Jan  2012 journal.jnl

./DATALOG:
total 296
drwxrwxrwx  1 unknown  staff   1024  1 Jan  2012 .
drwxrwxrwx@ 1 unknown  staff  16384 26 Feb 21:55 ..
-rwxrwxrwx  1 unknown  staff   5120  1 Jan  2012 AEE.EVN
-rwxrwxrwx  1 unknown  staff  26880  1 Jan  2012 BAE.EVN
-rwxrwxrwx  1 unknown  staff   3840  1 Jan  2012 BEE.EVN
-rwxrwxrwx  1 unknown  staff   6400  1 Jan  2012 DAE.EVN
-rwxrwxrwx  1 unknown  staff  33280  1 Jan  2012 DAF.EVN
-rwxrwxrwx  1 unknown  staff   5120  1 Jan  2012 ELV.EVN
-rwxrwxrwx  1 unknown  staff   3840  1 Jan  2012 FAE.EVN
-rwxrwxrwx  1 unknown  staff  26880  1 Jan  2012 RAE.EVN
-rwxrwxrwx  1 unknown  staff   6400  1 Jan  2012 REE.EVN
-rwxrwxrwx  1 unknown  staff   5120  1 Jan  2012 SRE.EVN
-rwxrwxrwx  1 unknown  staff   6400  1 Jan  2012 XSE.EVN

./ERRORLOG:
total 34
drwxrwxrwx  1 unknown  staff   1024  1 Jan  2012 .
drwxrwxrwx@ 1 unknown  staff  16384 26 Feb 21:55 ..

./SETTINGS:
total 60
drwxrwxrwx  1 unknown  staff   1024  1 Jan  2012 .
drwxrwxrwx@ 1 unknown  staff  16384 26 Feb 21:55 ..
-rwxrwxrwx  1 unknown  staff     27  6 Aug  2017 AGL.set
-rwxrwxrwx  1 unknown  staff     23  6 Aug  2017 AHL.set
-rwxrwxrwx  1 unknown  staff     80  1 Jan  2012 BGL.set
-rwxrwxrwx  1 unknown  staff    345  1 Jan  2012 BTP.set
-rwxrwxrwx  1 unknown  staff     20  6 Aug  2017 CGL.set
-rwxrwxrwx  1 unknown  staff    325  1 Jan  2012 DID.set
-rwxrwxrwx  1 unknown  staff     28  6 Aug  2017 EGL.set
-rwxrwxrwx  1 unknown  staff   1038  1 Jan  2012 MCF.set
-rwxrwxrwx  1 unknown  staff     28  6 Aug  2017 MGL.set
-rwxrwxrwx  1 unknown  staff     54  1 Jan  2012 MML.set
-rwxrwxrwx  1 unknown  staff     48  6 Aug  2017 PGL.set


The SPI Flash seems to contain the sleep data, but I'm stumped as to the format.  Anyone have a clue how they're storing the sleep data?  They use "FS NOR" repeatedly at the beginning of every page, but I couldn't find a match on the flash file format.  Anyone familiar with SleepyHead have any ideas about this?

Here's the flash dump I'm struggling with: Flash File Zip 16MB


RE: AirMini Travel Data Extraction & Teardown - ardenum - 02-27-2019

I guess you could directly contact SleepyHead devs on github


RE: AirMini Travel Data Extraction & Teardown - SuperSleeper - 02-27-2019

(02-27-2019, 06:13 AM)crowtor Wrote: I guess you could directly contact SleepyHead devs on github


The SleepyHead project is closed down for any new development.  It is being replaced by the OSCAR software program.

To contact the OSCAR developers, please see this thread:

http://www.apneaboard.com/forums/Thread-Admin-Note-Leadership-roles-in-the-AST-group-how-to-join-who-to-contact

OSCAR 1.0.0 will likely be released sometime in early March according to the developers, at which time we'll have an OSCAR download page prominently displayed at the top of every forum page, replacing the SleepyHead download page.

Coffee