|Some research into the MH-Z19 CO2 sensor|
- 1 Introduction
- 2 Status
- 3 Hardware and reference data
- 4 Software
- 5 Setting the measurement range
- 6 Experimentation
- 6.1 command 0x00-0x30
- 6.2 command 0x31-0x6F
- 6.3 command 0x62 (device name / id)
- 6.4 command 0x70
- 6.5 command 0x71, 0x72
- 6.6 command 0x73
- 6.7 command 0x80 - 0x83
- 6.8 command 0x84
- 6.9 command 0x85 (read CO2 + alarm level?)
- 6.10 Command 0x86 (read concentration)
- 6.11 command 0x89-0x8F
- 6.12 command 0x99 (range)
- 7 Log of MH-Z19 response at startup
This page is about the MH-Z19 CO2 sensor and some experiments done with it.
This sensor gives a digital (serial) output of the CO2 concentration in air, in parts-per-million (ppm). It uses the optical measurement principle of measuring CO2, which should be much more accurate than the inexpensive electro-chemical sensors you can find. As far as I know, the optical measurement principle uses a broadband light-source to send some light through an air-sample. The sensor then looks at the relative intensity of the light at two different frequencies. The CO2 gas inside the air absorbs light strongly at very specific wavelengths, allowing a determination of the concentration (ppm) of CO2. This is then compensated for temperature (and pressure?) for increased accuracy. See also wikipedia for this measurement principle. A new measurement is started every 5 seconds, you can actually see a small amount of light coming out of the sensor while it's measuring.
The MH-Z19 is the cheapest optical CO2 sensor I could find on AliExpress, about E22,-.
UPDATE: See also this page on geektimes.ru that explains some of the mysteries around this sensor that I didn't figure out.
The sensor works as intended, some software has been written to read the CO2 level and publish measurements it on MQTT. It is also clear how to change the measurement range from 0-2000ppm to 0-5000ppm in software.
Currently, it's running in Space3, publishing its value on a topic on MQTT, you can read this as follows:
mosquitto_sub -h revspace.nl -t revspace/sensors/co2/# -v
- play a bit more with the MH-Z19B commands and document what works and what doesn't.
- in particular, look at the alarm output (officially this output is not supported) and try to find if it is possible to set the alarm limit setting. The alarm output seems to toggle low/high on reboot of the sensor, so at least the required hardware to pull it low / high is present inside the sensor module.
- figure out what the unknown value is that comes out of the sensor.
Hardware and reference data
See this github repo for code using this sensor with an ESP8266 board (WeMos D1 mini). It publishes the CO2 concentration to a MQTT topic every 5 seconds.
It seems that support for this sensor was recently added to ESPEasy.
Setting the measurement range
The following command sequences can be used to configure the measurement range of the sensor:
- 1000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x03, 0xE8, 0x7B
- 2000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x07, 0xD0, 0x8F
- 3000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x0B, 0xB8, 0xA3
- 5000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x13, 0x88, 0xCB
Normally, this sensor is read out using a command/response sequence over serial (9600,8N1). The following commands are known from the datasheet:
- 0x86: gas concentration reading
- 0x87: calibrate zero point, I advise to AVOID SENDING THIS COMMAND, unless you know exactly what you are doing
- 0x88: calibrate span point, I advise to AVOID SENDING THIS COMMAND, unless you know exactly what you are doing
The MH-Z19B datasheet additionally mentions to following commands:
- 0x79: ABC logic on/off (ABC = automatic baseline correction)
- 0x99: Sensor detection range setting, this command can be used to set the measurement range (e.g. 0-2000ppm or 0-5000ppm)
It appears that these commands work on the MH-Z19 too, although with a little different command layout. Specifically, the range for command 0x99 is not put into bytes 3/4 but in bytes 6/7 of the command.
This paragraph describes some experiments done to discover other commands than the ones mentioned in the datasheet.
command 0x62 (device name / id)
According to the information at https://geektimes.ru/post/285572/
this command should return a kind of string, I couldn't get this to work unfortunately
Command 0x62 seems to query the sensor for a device name, either "KB200" or "MODBUS"
This command gives a response as follows:
9F 83 07 7D 00 00
The value 0x9F83 (40835 in decimal) looks similar to the output of command 0x84.
The value 0x077d (1917 in decimal) looks similar to the output of command 0x85.
command 0x71, 0x72
These commands give a response as follows:
00 00 00 00 00 00
9F 86 00 00 3D 40
0x9F86 = 40838 decimal, looks similar to output of command 0x84. 0x3d40 = 15680 decimal.
07 8C 00 00 3D 04
- 0x078c = 1932 decimal
- the 0x3D is temperature I think
- the 0x04 is the 'status' byte
command 0x80 - 0x83
This command gives a response as follows:
9F 88 00 00 00 00
The 0x88 byte seems to go up and down a bit.
Some other time
9F A1 00 80 00 00
command 0x85 (read CO2 + alarm level?)
This command gives a response as follows:
07 7D 01 D5 27 10
The 0x1D5 value is the same as the CO2 concentration reading from command 0x86! 0x077D is equivalent to 1917 decimal. 0x2710 is equivalent to 10000 decimal exactly.
Perhaps the 0x2710 value is the alarm value?
Command 0x86 (read concentration)
Command 0x86 is the command to send to just read out the most recent ppm value.
A response to command 0x86 typically looks like this:
0xFF CM HH LL TT SS Uh Ul CS
- CM is the command repeated back
- HH/LL is the CO2 ppm value, high/low part
- TT is the temperature in degrees Celcius, plus 40. For example, when temperature is 25 deg C, then TT = 0x41
- SS is some kind of status byte, this byte always has only one bit set!
- Uh/Ul is some unknown value, perhaps related to pressure? After booting the sensor, it starts out at 15000 exactly, then typically settles to about 10500.
According to the geektimes.ru page, this unknown value is related to the minimum CO2 uncorrected concentration measured in the past day. So I guess this is a relevant parameter from the ABC-algorithm.
- Cs is the checksum
Values TT, SS and Uh/Ul are undocumented.
No response is returned, however command 0x8d seems to reset the sensor.
command 0x99 (range)
According to the MH-Z19B datasheet, you can configure the measurement range by putting the desired range in byte 3 and 4. However, unlike what the MH-Z19B datasheet says, you can set the range using the following command (in this case 0x07d0 = 2000 ppm in byte 6 and 7):
0xFF 0x01 0x99 0x00 0x00 0x00 0x07 0xD0 0x8F <cmd> ^-range-^
Experimenting a bit: Sending all zeros gives a response of
01 00 00 00 00 00
Log of MH-Z19 response at startup
Below is a log of the sensor response to the 0x86 measurement command while starting up. The first couple of measurement seem to be invalid.
HH LL TT SS U1 U2 RAW: 00 80 47 01 3A 98 -> CO2 = 128 ppm RAW: 07 D0 47 01 3A 98 -> 0x7d0 = 2000 decimal, this is the configured measurement range of the sensor with command 0x99 RAW: 00 05 47 01 3A 98 -> CO2 = 5 ppm RAW: 01 2D 47 01 3A 98 -> CO2 = .. RAW: 28 97 47 01 3A 98 -> CO2 = 10391 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 01 3A 98 RAW: 28 97 47 40 3A 98 RAW: 28 97 47 40 3A 98 RAW: 03 84 47 40 2B 43 -> first sample with U different from 0x3a98 (15000 decimal) RAW: 03 85 47 40 2B 19 RAW: 03 86 47 40 2A F9 RAW: 03 87 47 40 2A E1 -> CO2 = 903 ppm, T = 31 deg C, Status = 0x40, Unknown = 10977
The first measurement shows a ppm value of 128, a temperature of 31 degrees C, a "status" byte of 01 and the "unknown" value of 0x3a98 (= 15000). The second measurement shows a high ppm value of 2000 ppm (the max value within the ppm range). The third measurement shows a low ppm value of 5 ppm. The fourth measurement shows a ppm value of 301 ppm. The fifth measurement shows a very high ppm value of 10391. The final measurement shows a realistic indoors ppm value of 0x387 = 903 ppm. The "unknown value" (byte 4/5) typically settles down to 10500 or so.
So, it takes some time before the measurement stabilizes, proposed heuristic for a valid reading:
- "status byte" has to be 0x40
- "unknown value" has to be lower than 15000