Recently i bought a never before used Standing Desk via Kleinanzeigen. My goal was to have a quick and cheap solution for some remote work from home.
It is a Flexispot E1 with the basic controller which only features two buttons for manually driving the table up or down.
So… if u are me, u probably already dissembled the controller while i write this up…
Normally with the more expensive height adjustable tables, you would find two drive units with a motor controller on each. The button controller then just talks some serial protocol with them.
Many projects on the web hijack this serial communication for adding remote capabilities to the table.
So i was hoping for some open unused UART Pins, but i was disappointed.
Reverse Engineering
If there is no open interface for me to play with, i have to understand the device from ground up. For this let me first introduce you to the features of the table.
- it can drive upwards
- it can drive downwards
- it stops it’s downward movement before colliding within the leg
- it stops it’s upward movement before losing the legs
- it knows it’s height after power loss
- it resets the bottom position, if u press down for longer, by driving in to a collision
And that’s pretty much it!
As a next step i poked the controller with some measurement devices while using it. This way i was able to identify each function for a section of the circuit. There is:
- A voltage regulator circuit
- A very obviously swd port
- The controller is powered by a STM32L011F4P6
- Two buttons which pull to Gnd if pressed
- The motor interface which lists
- GND
- 5V
- HALL1
- HALL2
- M1
- M1+
- Two relays can switch each motor pin between Gnd or +30V
- An op amp lm358 amplifies current sensing of the motor
- Filtering for the hall sensors
It then was an ease to identify the mcu pins.
Lisa and i sat on the table. While she was driving i measured the motor current voltage and the hall sensor outputs with my scope. It seems, that the controller only takes the motor current in account, while re calibrating its height (reset). There is nothing like a collision detection or weight limitation or other safety function behind it.
For the hall sensors i suppose a quadrature encoder interface.
For now i soldered some cables to the swd port, screwed the controller back together and mounted it under the table.