Airsense S10 Hardware
This page aggregates hardware details about the Airsense S10 electronics and other information that may be relevant to the reverse engineering process.
FCC Filings
One crucial reverse engineering resource is the FCC documentation for the AirSense S10, which includes external and internal schematics and user manuals.
The FCC filings for the AirCurve BiPAP, currently in use as an emergency ventilator, shows very similar electronics.
Clinical Manuals
Clinical manuals for the assisted-breathing devices from this manufacturer provide a great deal of insight into the various models in the AirSet and AirCurve lines, as well as the ventilation features available in each one. Many of the menu options restricted to other models can be enabled by flipping configuration bits in the firmware.
Components
Here are some of the components on the AirSense S10
Main PCB
| Part | Part No. | Manufacturer | Reference | Additional |
|---|---|---|---|---|
| Main uC | STM32F405ZGT6 (LQFP144) | STMicroelectronics | Datasheet | Reference Manual |
| Aux uC | STM8S005 (TQFP48) | STMicroelectronics | Datasheet | Reference Manual |
| Power watchdog IC | POWR605 | Lattice | Datasheet | Monitors pressures - see notes below |
| Main Pressure Sensor | NPA-300M-015A | Amphenol | Datasheet | Operates in analog mode |
| Differential Pressure Sensor | SDP8xx | Sensirion | Datasheet | Digital mode, manifold mount |
| Programming Header | TC2050-IDC | Tag-Connect LLC | DigiKey | |
| Motor Driver | DRV8302 | Texas Instruments | DigiKey | |
| Serial EEPROM | M95M02 | STMicroelectronics | Datasheet | |
| LCD | TM024HDZ29 | Tianma | Similar datasheets | Closest we could find |
| Relay Driver | A2550 | Allegro | Datasheet | Function unknown; accessory? |
| Logic Voltage Regulator (x2) | ISL9000A | Renesas | Datasheet | Generates 3.3v and 5v logic voltages |
| Top Switch | B3F-3125 | Omrom | Digikey | In case switch needs to be replaced (confirmed exact fit) |
Cellular Module & Antenna (CAM) Board
| Part | Part No. | Manufacturer | Reference | Additional |
|---|---|---|---|---|
| Main uC | R5F5210ABDFP | Renesas | Datasheet | LFQFP 100-pin |
| CDMA Radio Module | ce910-dual | Telit | Datasheet | qualcomm qsc1105 chipset |
| 3G Radio Module | HE910-D | Telit | Datasheet | Uknown chipset- FCC photos obscured |
| 4G Radio Module | cinterion els61-us | Gemalto | Datasheet | Cat 1 LTE w/ 2G/3G fallback |
Alarm Board (Only A10STACD, A10STA3G, AIR104G)
| Part | Part No. | Manufacturer | Reference | Additional |
|---|---|---|---|---|
| Main uC | R5F21358CNFP | Renesas | Datasheet | Avnet |
Power Watchdog
The power watchdog IC (POWR605) is a complicated power watch-dog IC. More than just a basic device, it contains:
- 6 DC power monitoring inputs.
- 16 macrocell PLD logic.
- 4 timers.
The 6 inputs have programmable thresholds (despite what the datasheet implies about fixed).
This device is important as appears to be used as a "safety" on pressure sensors. If pressures are too far out-of-spec it will reset the main STM32F407ZG microcontroller. More reverse engineering is needed to understand the exact connection here.
The POWR605 logic should be reprogrammable via the tag-connect header. The following works (but may not be easiest/lowest-cost):
- "Lattice Diamond" programming software.
- Programming Cable supported by above (such as HW-USBN-2B).
- Lattice "PAC-Designer" software.
To read the device, ensure you configure the Lattice Diamond SW to perform a "JEDEC Readback" - the default operation is erase/program/verify. This will then generate a .jed file.
From PAC-Designer, create a new project with the POWR605. You can then use the Import option to open the .jed to see configuration.