AirMini Travel Data Extraction & Teardown
I purchased an AirMini for a backup and for travel to my AirSense 10.
There's a couple of problems with the AirMini Travel. One is the noise! (but a couple of 3D printed adapters and a muffler and I have that one reduced significantly, got 7.5 hours last night, usable finally, a better 3D printed muffler too is in the works to improve that further).
The other is no access to the fine grained patient data recorded without AirView, so, I did a teardown on mine, to see what can be done to access that data. I resent paying over $1000 for a machine that won't give me access to my personal data I'm generating, but feels it acceptable to upload that to the cloud and use it for their own purposes whilst essentially compromising my own health by not letting me monitor the data myself without a DME. (rant over)
So... I opened it up with a view to getting at the data. Getting in is fairly easy if anybody wants to do the same without
breaking / damaging it. Remove the filter to remove the 2 screws, then the grey plastic just pulls off. At the other end (where it says "Airmini Autoset" on the darker gray plastic cap, a small flat screwdriver or supdger under the edge between the white rubber and the end of the cap will lever the clip to remove that cap, then there's another screw to remove.
Once that's done the white rubber coated cover (the half with the buttons on), can be easily unclipped. Getting at the other side of the circuit board can be done by pushing the black clip on the 3 wire FPC down 90 degrees and removing the FPC, then another screw and the PCB will lift up to access underneath (although there's nothing of note underneath apart from the Bluetooth Module)
** There are no anti tamper switches, machine works fine when reassembled **
A quick look at the PCB reveals:
10 pin (pogo type) header (I would assume is JTag)
STM32F469IG Arm Cortex M4 - 180MHz - 32bit, 1MByte Flash
IS25LP128 - 16MByte SPI Flash - ** Likely where the patient data is stored. **
MB85RS2MT 2MBit FRAM - (I would guess being used as RAM)
Blue Giga BT121-A Bluetooth Module
ispPAC-POWR605-01SN24I - Supervisor IC
VP233 / SN65HVD234 (deduced from the markings, but not confirmed) - CAN Bus Transceiver (near the power connection)..
From the size of the small 2 inner traces compared to the "power" outer traces, this suggests the power port will allow CAN Bus data transfer, i.e. it's not USB
So potentially 4 ways to get at the data:
1. Clip directly onto the flash (they've graciously included test pads on the pins which could be soldered to too)
2. CAN Bus
3. JTAG
4. Tap into the Bluetooth Module
I didn't bother pulling disassembling the air box (as I'm just after my data), but if that interests you, everything can be unscrewed
from that point on. The fan is a 3 phase brushless dc motor supplied by a DRV8302 (used for CPAPs)
If there's enough interest, I'll post my findings, teardown photos and data dumps. "Theoretically" it shouldn't be too difficult to dump out the flash and start figuring out the data format, and then figure a mod pcb to extract data on a regular basis without having to teardown each time, or extract over CAN bus.
I will likely need some help from people familiar with the formats resmed use to store their data to reverse engineer the data format. They may have just setup the flash as FAT, in which case it shouldn't be too difficult.
And obviously doing this will void your warranty and may impact your health and all the other disclaimers, although it comes apart and reassembles cleanly.
Lastly, can a moderator deny/confirm if treardown photos/data dumps would be permitted on this forum or not.
There's a couple of problems with the AirMini Travel. One is the noise! (but a couple of 3D printed adapters and a muffler and I have that one reduced significantly, got 7.5 hours last night, usable finally, a better 3D printed muffler too is in the works to improve that further).
The other is no access to the fine grained patient data recorded without AirView, so, I did a teardown on mine, to see what can be done to access that data. I resent paying over $1000 for a machine that won't give me access to my personal data I'm generating, but feels it acceptable to upload that to the cloud and use it for their own purposes whilst essentially compromising my own health by not letting me monitor the data myself without a DME. (rant over)
So... I opened it up with a view to getting at the data. Getting in is fairly easy if anybody wants to do the same without
breaking / damaging it. Remove the filter to remove the 2 screws, then the grey plastic just pulls off. At the other end (where it says "Airmini Autoset" on the darker gray plastic cap, a small flat screwdriver or supdger under the edge between the white rubber and the end of the cap will lever the clip to remove that cap, then there's another screw to remove.
Once that's done the white rubber coated cover (the half with the buttons on), can be easily unclipped. Getting at the other side of the circuit board can be done by pushing the black clip on the 3 wire FPC down 90 degrees and removing the FPC, then another screw and the PCB will lift up to access underneath (although there's nothing of note underneath apart from the Bluetooth Module)
** There are no anti tamper switches, machine works fine when reassembled **
A quick look at the PCB reveals:
10 pin (pogo type) header (I would assume is JTag)
STM32F469IG Arm Cortex M4 - 180MHz - 32bit, 1MByte Flash
IS25LP128 - 16MByte SPI Flash - ** Likely where the patient data is stored. **
MB85RS2MT 2MBit FRAM - (I would guess being used as RAM)
Blue Giga BT121-A Bluetooth Module
ispPAC-POWR605-01SN24I - Supervisor IC
VP233 / SN65HVD234 (deduced from the markings, but not confirmed) - CAN Bus Transceiver (near the power connection)..
From the size of the small 2 inner traces compared to the "power" outer traces, this suggests the power port will allow CAN Bus data transfer, i.e. it's not USB
So potentially 4 ways to get at the data:
1. Clip directly onto the flash (they've graciously included test pads on the pins which could be soldered to too)
2. CAN Bus
3. JTAG
4. Tap into the Bluetooth Module
I didn't bother pulling disassembling the air box (as I'm just after my data), but if that interests you, everything can be unscrewed
from that point on. The fan is a 3 phase brushless dc motor supplied by a DRV8302 (used for CPAPs)
If there's enough interest, I'll post my findings, teardown photos and data dumps. "Theoretically" it shouldn't be too difficult to dump out the flash and start figuring out the data format, and then figure a mod pcb to extract data on a regular basis without having to teardown each time, or extract over CAN bus.
I will likely need some help from people familiar with the formats resmed use to store their data to reverse engineer the data format. They may have just setup the flash as FAT, in which case it shouldn't be too difficult.
And obviously doing this will void your warranty and may impact your health and all the other disclaimers, although it comes apart and reassembles cleanly.
Lastly, can a moderator deny/confirm if treardown photos/data dumps would be permitted on this forum or not.
![[Image: lftSoP0.jpg]](https://www.apneaboard.com/images/lftSoP0.jpg)
![[Image: rvNbitq.jpg]](https://www.apneaboard.com/images/rvNbitq.jpg)
![[Image: Yn2ErnT.jpg]](https://www.apneaboard.com/images/Yn2ErnT.jpg)
![[Image: WKQiywW.jpg]](https://www.apneaboard.com/images/WKQiywW.jpg)
![[Image: 860CwL3.jpg]](https://www.apneaboard.com/images/860CwL3.jpg)
