Awesome Open Source
Awesome Open Source


Version Version
Poll Xiaomi Flower Care (MiFlora) sensors without relying on the official app

About Mi Flora

  • Xiaomi Flower Care (MiFlora) sensors (e.g. 12-17€) are meant to keep your plants alive by monitoring their environment
  • Has sensors to relay temperature, light intensity, soil moisture and soil fertility (via electrical conductivity)
  • Uses Bluetooth Low Energy (BLE) and has a rather limited range
  • A coin cell battery is used as power source, which should last between 1.5 to 2 years under normal conditions
  • Food for thought: The sensor can also be used for other things than plants, like in the fridge or as door and blind sensor

Features

  • Device discovery
  • Read name
  • Read firmware version
  • Read battery level
  • Read real-time sensor values
  • Read historical sensor values
  • Clear historical sensor values
  • Blink LED

Install

$ pip3 install git+https://github.com/vrachieru/xiaomi-flower-care-api.git

or

$ git clone https://github.com/vrachieru/xiaomi-flower-care-api.git
$ pip3 install ./xiaomi-flower-care-api

Usage

Device discovery

import json
from collections import OrderedDict
from flowercare import FlowerCare, FlowerCareScanner

# Initialize the scanner with BT interface and a 
# custom callback for newly discovered devices.
scanner = FlowerCareScanner(
    interface='hci0',  # hci0 is default, explicitly stating for demo purpose
    callback=lambda device: print('Found device', device.addr) # any lambda with the device as the sole argument will do
)

# Scan advertisements for 10 seconds 
# and return found device list.
devices = scanner.scan(timeout=10)

# Iterate over results and query the information 
# for each individual device.
device_information = OrderedDict()
for device in devices:
    device = FlowerCare(
        mac=device.addr, # address of the device to connect to
        interface='hci0' # hci0 is default, only explicitly stating for demo purpose
    )
    device_information[device.mac] = OrderedDict([
        ('name', device.name),
        ('firmware', device.firmware_version),
        ('battery', device.battery_level),
        ('measurements', device.real_time_data.__dict__)
    ])

# Pretty print device information
print(json.dumps(device_information, indent=4))
$ sudo python3 scan.py
Found device c4:7c:8d:xx:xx:xx
Found device c4:7c:8d:yy:yy:yy

{
    "c4:7c:8d:xx:xx:xx": {
        "name": "Flower care",
        "firmware": "3.1.9",
        "battery": 99,
        "measurements": {
            "temperature": 23.7,
            "moisture": 23,
            "conductivity": 210,
            "light": 89
        }
    },
    "c4:7c:8d:yy:yy:yy": {
        "name": "Flower care",
        "firmware": "3.1.9",
        "battery": 100,
        "measurements": {
            "temperature": 25.2,
            "moisture": 68,
            "conductivity": 1980,
            "light": 3587
        }
    }
}

Reading device information and sensor data

from flowercare import FlowerCare

# Initialize FlowerCare device
device = FlowerCare(
    mac='c4:7c:8d:xx:xx:xx', # device address
    interface='hci0' # hci0 is default, explicitly static for demo purpose
)

print('Getting data from device..\n')

# Display generic device information
print('Name: {}'.format(device.name))
print('Address: {}'.format(device.mac))
print('Firmware: {}'.format(device.firmware_version))
print('Battery: {}%'.format(device.battery_level))

# Display current sensor readings
print('\nReal-time data\n----')
real_time_data = device.real_time_data
print('Temperature: {}°C'.format(real_time_data.temperature))
print('Moisture: {}%'.format(real_time_data.moisture))
print('Light: {} lux'.format(real_time_data.light))
print('Conductivity: {} µS/cm'.format(real_time_data.conductivity))

# Display historical sensor readings
print('\nHistorical data\n----')
historical_data = device.historical_data
for entry in historical_data:
    print('Timestamp: {}'.format(entry.timestamp))
    print('Temperature: {}°C'.format(entry.temperature))
    print('Moisture: {}%'.format(entry.moisture))
    print('Light: {} lux'.format(entry.light))
    print('Conductivity: {} µS/cm\n'.format(entry.conductivity))
$ sudo python3 read.py
Getting data from device..

Name: Flower care
Address: C4:7C:XX:XX:XX:XX
Firmware: 3.1.9
Battery: 99%

Real-time data
----
Temperature: 23.6°C
Moisture: 23%
Light: 68 lux
Conductivity: 211 µS/cm

Historical data
----
Timestamp: 2018-09-30 23:00:00
Temperature: 23.7°C
Moisture: 23%
Light: 24 lux
Conductivity: 211 µS/cm

Timestamp: 2018-09-30 22:00:00
Temperature: 24.1°C
Moisture: 24%
Light: 24 lux
Conductivity: 212 µS/cm

Timestamp: 2018-09-30 21:00:00
Temperature: 24.5°C
Moisture: 24%
Light: 164 lux
Conductivity: 212 µS/cm

...

Blink

from flowercare import FlowerCare

# Initialize the FlowerCare device
device = FlowerCare(
    mac='c4:7c:8d:xx:xx:xx', # device address
    interface='hci0' # hci0 is default, explicitly static for demo purpose
)

# Blink
device.blink()

Protocol

The device uses BLE GATT for communication, but the sensor values are not immediately available.
When the original app connects to the device, it performs an elaborate initialization, but most of it isn't required.

BLE & GATT

The basic technologies behind the sensors communication are Bluetooth Low Energy (BLE) and GATT.
They allow the devices and the app to share data in a defined manner and define the way you can discover the devices and their services.
In general you have to know about services and characteristics to talk to a BLE device.

Adafruit's Kevin Townsend has published a really nice introduction on the subject and if you don't know about BLE and/or GATT you should definitely give it a look.

Services, characteristics and handles

Root service
Service UUID Characteristic UUID Handle Read/Write Description
0000fe95-0000-1000-8000-00805f9b34fb - - - used for device discovery
Generic access
Service UUID Characteristic UUID Handle Read/Write Description
00001800-0000-1000-8000-00805f9b34fb 00002800-0000-1000-8000-00805f9b34fb 0x0003 read device name
Data service
Service UUID Characteristic UUID Handle Read/Write Description
00001204-0000-1000-8000-00805f9b34fb 00001a00-0000-1000-8000-00805f9b34fb 0x0033 write device mode change (send command)
00001204-0000-1000-8000-00805f9b34fb 00001a01-0000-1000-8000-00805f9b34fb 0x0035 read get real-time sensor values
00001204-0000-1000-8000-00805f9b34fb 00001a02-0000-1000-8000-00805f9b34fb 0x0038 read get firmware version and battery level
00001204-0000-1000-8000-00805f9b34fb 00001a11-0000-1000-8000-00805f9b34fb 0x003c read get historical sensor values
00001204-0000-1000-8000-00805f9b34fb 00001a10-0000-1000-8000-00805f9b34fb 0x003e write
00001204-0000-1000-8000-00805f9b34fb 00001a12-0000-1000-8000-00805f9b34fb 0x0041 read device time
Little endian

Data structure

The data is encoded on bytes in Little endian.
This means that the data is represented with the least significant byte first.

To understand multi-byte integer representation, you can consult this Wikipedia page.

Name

A read request to the 0x03 handle will return n bytes of data, for example 0x466c6f7765722063617265 corresponding to the device name.

Position 00 01 02 03 04 05 06 07 08 09 10
Value 46 6c 6f 77 65 72 20 63 61 72 65
Bytes Type Value Description
all ASCII text Flower Care device name

Firmware and battery

A read request to the 0x38 handle will return 7 bytes of data, for example 0x6328332e312e39.

Position 00 01 02 03 04 05 06
Value 63 28 33 2e 31 2e 39
Bytes Type Value Description
00 uint8 99 battery level in %
02-06 ASCII text 3.1.8 firmware version

The second byte (0x28) seems to be a separator. In older firmware versions it always read 0x13.
Both are control characters in the ASCII table.

Device time

A read request to the 0x41 handle will return 4 bytes of data, for example 0x09ef2000.

Position 00 01 02 03
Value 09 ef 20 00
Bytes Type Value Description
00-03 uint32 2158345 seconds since device epoch (boot)

Considering the device's epoch as second 0, the value obtained is a delta from now from which we can determine the actual time.
We use this method while determining the datetime of historical entries.

Real-time data

In order to read the sensor values you need to change its mode.
This can be done by writing 2 bytes (0xa01f) to the mode change handle (0x33).
After writing them you can read the actual sensor values from the data handle (0x35).

A read request will return 16 bytes of data, for example 0xea0000ab00000015b200023c00fb349b.

Position 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
Value ea 00 00 ab 00 00 00 15 b2 00 02 3c 00 fb 34 9b
Bytes Type Value Description
00-01 uint16 234 temperature in 0.1 °C
02 ? ? ?
03-06 uint32 171 brightness in lux
07 uint8 21 moisture in %
08-09 uint16 178 conductivity in µS/cm
10-15 ? ? ?

Historical data

The device stores historical data when not connected that can be later synchronized.
As with reading real-time sensor information, we need to change the device mode by writing 3 bytes (0xa00000) to the history control handle (0x3e).

Entry count

The next step is to get information about the stored history by reading from the history data handle (0x3c).
This will return 16 bytes of data, for example 0x2b007b04ba130800c815080000000000.

Position 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
Value 2b 00 7b 04 ba 13 08 00 c8 15 08 00 00 00 00 00
Bytes Type Value Description
00-01 unint16 43 number of stored historical records
02-15 ? ? ?
Read entry

Next we need to read each historical entry individually.
To do so we need to calculate it's address, write it to the history control handle (0x3e) and then read the entry from the history data handle (0x3c).

The address for each individual entry is computed by adding two bytes representing the entry index to 0xa1.
Entry 0's address will be 0xa10000, entry 1's address 0xa10100, entry 16's address 0xa11000, and so on...

After writing the address of the entry to be read, be can do so by requesting the payload from the history read handle (0x3c).
This will return 16 bytes of data, for example 0x70e72000eb00005a00000015b3000000.

Position 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15
Value 70 e7 20 00 eb 00 00 5a 00 00 00 15 b3 00 00 00
Bytes Type Value Description
00-03 uint32 2156400 timestamp, seconds since device epoch (boot)
04-05 uint16 235 temperature in 0.1 °C
06 ? ? ?
07-09 uint32 90 brightness in lux
10 ? ? ?
11 uint8 21 moisture in %
12-13 uint16 179 conductivity in µS/cm
14-15 ? ?
Clear entries

Once all entries have been read, they can be wiped from the device by marking the process as successful.
This can be achieved by writing 3 bytes (0xa20000) to the history control handle (0x3e).

Blink

Writing 2 bytes (0xfdff) to the mode change handle (0x33) will make the device blink the top LED once.

Reference

[1] https://wiki.hackerspace.pl/projects:xiaomi-flora
[2] https://awesomeopensource.com/project/open-homeautomation/miflora
[3] https://awesomeopensource.com/project/ChrisScheffler/miflora

License

MIT

Related Awesome Lists
Top Programming Languages
Top Projects

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Python (806,773
Sensor (15,816
Iot (11,916
Ble (2,945
Reverse Engineering (2,310
Home Automation (2,212
Xiaomi (2,109
Smarthome (1,592
Bluetooth Low Energy (740
Plants (218
Gatt (44
Miflora (10