Bruce's Blog Just another in the neverending world of blogs

17Jul/150

Hacking Big Ass fans with SenseME to control them remotely

Big Ass Solutions (I love that name) has an advanced ceiling fan called Haiku that includes an optional wifi-enabled component called SenseME, which is designed to be controlled by a smartphone app. Big Ass Solutions does not currently make an API available for SenseME, which is very unfortunate for folks who would like to incorporate their fans into third party home automation systems.

DISCLAIMER: What follows is information that I gleaned solely by analyzing the network traffic between the SenseME app and a Haiku fan.  None of this information is provided or supported by Big Ass Solutions, and it may change at any moment if Big Ass Solutions decides to do so. Use this information solely at your own risk. I make no guarantees whatsoever as to the current accuracy of this information. I also make no guarantees that by using this information you won't irreparably damage your Haiku fan (bricking the SenseME, etc).

Fortunately, they use a relatively simple protocol for controlling the fans. To figure out exactly how the smartphone app and the fan communicate with one another I simply ran wireshark or tcpdump to trace network traffic to/from my iPhone. Fortunately Apple makes it fairly easy to capture packet traces of iPhones by creating a remote virtual interface (RVI) on a Mac.  All it requires is XCode, which you can download from the Mac App Store.  I won't go into details of setting up an RVI since Apple provides fairly easy instructions on how to do it.

By tracing the network activity of the SenseME app I was able to quickly determine that the app and the fan communicate via UDP on port 31415, and the commands are all in a fairly simple plaintext format.  A command sent from the app to the fan is just a text string that looks like this:

<ALL;DEVICE;ID;GET>

Responses sent from the fan back to the app are in a similar format, but uses parenthesis instead:

(Living Room;LIGHT;PWR;ON)

The number & meaning of each parameter in the command or response varies depending on the command/response.

When the smartphone app starts up it broadcasts a <ALL;DEVICE;ID;GET> message on UDP port 31415 so that all the fans on the same network can receive it.  The fans, in response, send a series of responses back as a number of parenthesis-delimited strings to the IP address that issued the request.  In this way the smartphone app gets a snapshot of the entire current state of the fan.

When the SenseME app sends a command to a specific fan then the first parameter in the message is typically the MAC address of the fan.  It appears that the fan will also respond if the first parameter is the name of the fan, so the following two commands should effectively be identical, assuming "Living Room" is the name given to the fan with the MAC address 20:F8:5E:AB:31:1B:

<20:F8:5E:AB:31:1B;FAN;SPD;GET;ACTUAL>
<Living Room;FAN;SPD;GET;ACTUAL>

The fan will send some status messages via UDP broadcast so that all devices on the network that are listening on port 31415 can get updates. This way if you happen to have two or more smartphones all running the SenseME app and one of them changes the speed of the fan then all the apps are notified of the new fan speed.

Here are a few of the more basic commands that I've made use of in my testing/analysis of the fan.  Remember that the SenseME app sends commands enclosed in <> and the response(s) from the fan are enclosed in ().  I've also colored the commands in blue and the responses in red:

Set fan speed to 3:

Command from app: <Living Room;FAN;SPD;SET;3>
Responses from fan:
(Living Room;FAN;SPD;ACTUAL;3)
(Living Room;FAN;PWR;ON)
(Living Room;FAN;SPD;CURR;3)

Turn the fan off:

Command from app: <Living Room;LIGHT;PWR;OFF>
Responses from fan:
(Living Room;LIGHT;LEVEL;SCALE;0)
(Living Room;LIGHT;LEVEL;ACTUAL;0)
(Living Room;LIGHT;PWR;OFF)
(Living Room;LIGHT;LEVEL;CURR;0)
(Living Room;LIGHT;PWR;OFF)
(Living Room;LIGHT;LEVEL;CURR;0)

Turn the fans motion detector on:

Command from app: <Living Room;FAN;AUTO;ON>
Responses from fan:
(Living Room;FAN;AUTO;ON)
If the motion detector senses motion then this may be immediately followed by:
(Living Room;FAN;PWR;ON)
(Living Room;FAN;SPD;CURR;3) 
(Living Room;FAN;AUTO;ON)

As you can see from the above examples it's not uncommon to receive multiple responses from a single command sent to the fan. In some cases it's also possible to see the exact same response twice, like receiving "LIGHT;LEVEL;CURR;0" when the light is turned off.

I'm currently only interested in basic functionality like turning the fan on/off, adjusting the speed, and turning features like the motion sensor on/off so I haven't delved into a lot of these responses.  There are some responses like "(Living Room;LIGHT;LEVEL;SCALE;16383)" that I haven't bothered to try to understand, or why you might receive both a "FAN;SPEED;CURR" and "FAN;SPEED;ACTUAL" when they seem to always appear together and provide the same data.

This should provide enough of a basic primer for how to interact with Haiku Fans that have the SenseME option installed.  Good luck!

 

Tagged as: , No Comments