Urban Cultivator and Right To Repair

I'm a big fan of owning and repairing my own things. I often buy things that do not work, are in "unknown condition" or expected to need service in the future that precludes normal people from buying it.

Anyway, I bought this "plant fridge" from a public institution at auction. It was "barely used" but was initially acquired at great expense, allegedly >$10k of our hard earned tax dollars.

A few things were noticed to be wrong with it immediately:
1) Crack in plastic basin

2) Default password did not work on LCD, time was very incorrect

3) Screen was damaged.

4) Water level on LCD slowly creeps down to 0% despite no water loss.

Usually, there is a lot of information available online about various things and I don't have to contribute my learnings online. In this case, the only other person I found with a non-working unit repurposed the unit replacing its guts. I did not want to do that.

I decided my first course of action would be to write the manufacturer. Like others online, I was told I must replace all the guts with their newer version at a cost >$1000US. LCDs are "no longer available" and shucks to you about the password not working. Also the basin is not available since it would require full disassembly of the machine. They refused to share any manuals, firmware etc. beyond what was on their website. The system is using GPL software as part of it's firmware, but even that was not shared.

Anyway... The manufacturer had the money long ago and had little interest in helping with or without further business on the line.

Problem 1:
The basins can be plastic welded. Easy peasy. It can actually be removed. The entire exterior cabinet appears to be built with a service like vention.io with an aluminum extrusion frame. The thermoformed plastic is riveted in to place and glued with a silicone. It would be a lot of work, but completely possible.

Problem 2:
Though the default password did not work for the display, there is a secret backdoor passcode hard coded in the app on the LCD controller. The LCD controller is a slightly customized EmbedSky TQ2440 dev board running the customized EmbedSky Linux that comes on the CD with the development board. Here is the development board manual.
You can find the kernel source code and crosscompile toolkit here. I was able to compile on Ubuntu 12.7 when the environment was set up with only one change to kernel/timeconst.pl removing the defined() function. Setting up the build environment required adding lib32z1, lib32ncurses, libbz2 and a bunch of other build dependencies. Then of course adding "ARCH=arm CROSS_COMPILE=arm-linux-" to the make command.
The main Urban Cultivator contribution is a QT application. On mine, you can find that in: /opt/qt-4.5/bin/cc130908. To find the hard coded service passcode, the linux command "strings /opt/qt-4.5/bin/cc130908|less" will point you to it. It's the 4 digit number after the string "ENTER PASSCODE AGAIN". Simply connect to the serial port on the board behind the LCD to run the command. I won't share it here but you can ask it from me or ask the manufacturer now that you know it exists. When you use it, it brings you to a secret menu with dosing settings and zero level reset. You can then exit the menu, press menu again, to be taken to the regular menus.
The time/date displayed on the LCD is not from the system clock on the LCD controller, but is instead from the control board. This main control board seems to be a custom PIC based controller. I have the necessary hardware to dump the firmware from it, but have not yet done so. Replacing the battery, resetting to factory defaults, then programming in the time using the recovered master code seemed to have fixed the date/time issue.

Problem 3:
The damaged LCD is actually a KD43G18-40NB-A1. 480x272px display. They can be had on Aliexpress with the touchscreen for $25CAD or scavenged from various different electronics. It is stuck with adhesive to an adapter board that appears to be unobtanium.

Problem 4:
The water level is measured using a PVC pipe with a hose to a barometric sensor on the control board. I tested the same for leaks with no success. I have currently cheated the system by putting a bubbler under the PVC pipe which forces out the excess water that seemed to be making it into the pipe. I intend to 3d print a bottom cap with tiny hole to see if it's just the turbulence of the water or something removing the air. It could also be the wide temperature changes or a leak in the barometric sensor itself.

Additionally I learned, the black 1020 trays and clear humidity domes, as well as the light fixtures and bulbs are made by Sunblaster. You can get the 18" fixture, bulb, dome and tray as the "Sunblaster Mini Greenhouse" for just a few dollars more than the manufacturer will sell you a bulb. The 18" Sunblaster fixtures alone are sold at Canadian Tire. Of course you can get your own microgreen seeds by harvesting them yourself or any other supplier.

I plan to do further reverse engineering on the system.
So far, I know the LCD board communicates with the PIC based control board over the third serial port enumerated as /dev/tq2440_serial2 which takes the place of the LAN port on a standard EmbedSky board. I don't know yet if this is rs232 or rs485... but shouldn't matter.
I have added a USB WUSB54G wireless adapter and compiled rt2500usb module from the embedsky kernel sources and it was able to load up no problem. I used config_EmbedSky_W43 as my starting .config file for kernel/module compilation.

Note the kernel version on the TQ2440 is 2.6.30.4 and userland libc is 2.8. The ARM9 is actually ARM architecture ARMv4T which is softfp. Most arm distros have dropped support for anything without hard floating point support which means if you choose to go with a newer linux userland, you will likely have to compile it yourself, and may need to port in fixes.

I expected the CRUX-ARM 2.8 to work but all of the compiled binaries fail with illegal instruction... I then tried debian squeeze for armel and was able to chroot and execute - so I used multistrap to create an overlay to extract over the previous file system.

After, I edited /bin/qt4:
strace -f -s9999 -x -e trace=read,write,ioctl -o /mnt/sd/qt.trace.log $QPEDIR/bin/cc130908 -qws 1> /mnt/sd/qt.log 2>&1

Kill and relaunch the Urban Cultivator app

-bash-4.1# grep "892 read(16, " /mnt/sd/qt.trace.log >/mnt/sd/reads.trace

-bash-4.1# cat /mnt/sd/reads.trace | sed -e 's/\\x/ /g'|gawk '

BEGIN{FS=" "}{

le=strtonum("0x" $22);

yy=strtonum("0x" $18);

MM=strtonum("0x" $17);

dd=strtonum("0x" $16);

hh=strtonum("0x" $15);

mm=strtonum("0x" $14);

ss=strtonum("0x" $13);

ph=strtonum("0x" $4)*.1;

t1=strtonum("0x" $5);

h1=strtonum("0x" $6);

t2=strtonum("0x" $7);

h2=strtonum("0x" $8);

t3=strtonum("0x" $9);

h3=strtonum("0x" $10);

t4=strtonum("0x" $11);

h4=strtonum("0x" $12);

if( hh > 24 || mm > 60 || ss > 60 || MM > 12 || dd > 31 || yy != 24){print "Date check invlid:" $0}else{print yy "-" MM "-" dd " " hh ":" mm ":" ss " " ph " " t1 " " t2 " " t3 " " t4 " " h1 " " h2 " " h3 " " h4 " " le}

Date check invlid:892 read(16, " 3a 18 18 18 19 28 28 28 28 02 02 02 00 07 07 06 00 11 0a 0d 0a 07 01 01 01 01 00 01 ec 0d 0a", 31) = 31

24-11-7 22:54:52 5.8 33 33 33 30 33 33 31 39 60

24-11-7 22:54:52 5.8 33 33 33 30 33 33 31 39 61

24-11-7 22:54:54 5.8 33 33 33 30 33 33 31 39 61

24-11-7 22:54:55 5.8 33 33 33 30 33 33 31 39 61

24-11-7 22:54:56 5.8 33 33 33 30 33 33 31 39 61

24-11-7 22:54:57 5.8 33 33 33 30 33 33 31 39 61

24-11-7 22:54:59 5.8 33 33 33 30 33 33 31 39 60

24-11-7 22:54:59 5.8 33 33 33 30 33 33 31 39 61

Date check invlid:892 read(16, " 3a 01 18 07 19 5a 01 26 03 78 3c 01 01 00 06 00 00 07 4b 37 ff 07 01 01 78 3c 11 00 e7 0d 0a", 31) = 31

24-11-7 22:55:3 5.8 33 33 33 30 33 33 31 39 62

24-11-7 22:55:4 5.8 33 33 33 30 33 33 31 39 61

Looks like there are a few messages I don't understand, but the humidity and temp and basin level values seem to reflect the LCD readouts - hopefully I can feed them into mqtt and into Home Assistant

Of course: all of this is unsupported by the manufacturer. I'll probably post some scripts to gitlab

And on later thought... no need to use strace... you can watch the FD from procfs... maybe this is the way to do it...

root@EmbedSky ~

# head -n 10 /proc/`pidof cc130908`/fd/16| perl -pe 's/(.)/sprintf("\%d ", ord($1))/eg' 2>/dev/null

58 24 72 24 50 22 65 21 53 36 13 16 29 11 24 16 0 0 86 0 70 0 0 3 35 18 85 187 173 13

58 24 72 24 50 22 64 21 53 37 13 16 29 11 24 16 0 0 86 0 70 0 0 3 35 18 85 215 236 13

58 24 72 24 50 22 64 21 53 38 13 16 29 11 24 16 0 0 86 0 70 0 0 3 35 18 85 39 28 13