AQC-0-0-0-0

From RevSpace
Revision as of 03:39, 5 January 2021 by Juerd (talk | contribs)
Jump to navigation Jump to search
Project AQC-0-0-0-0
Aqc-pcb-top.jpg
Reverse engineering a CO2 sensor
Status In progress
Contact Sebastius, Xesxen, Juerd
Last Update 2021-01-05
The AQC-0-0-0-0 (top) in use in an Operame CO2-meter with a TTGO T-Display showing the current CO2 level in PPM.

The AQC-0-0-0-0 is a CO2 sensor, much like the MH-Z19B. We have no idea who makes these and where they can be bought, but it's an aesthetically pleasing device that seems to work at least as well as the famous MH-Z19B. It has the same form factor and is pin compatible. Regarding the protocol it is only compatible with the MH-Z19 for the commands 0x86 and 0x87.

The sensor communicates using 5V-tolerant 3.3V TTL serial, 9600 8N1.

Since the datasheet is lacking in instructions on how to use it, and information about the sensor couldn't be found online anywhere, we've tried to reverse-engineer the device to figure out the protocol.

Teardown

Protocol

  • Query: id 01 cc p1 p2 p3 p4 p5 cs
id Device BUS id? Is 0xFF for our device, but seems variable.
cc Command (e.g. 0x86)
px Parameters, left at 00 when there are none
cs Checksum

Commands

0x86 or 0xC5: Request CO2 level

  • Parameters: none.
  • Response: FF 86 hh ll 00 00 00 00 cs, where the CO2 level is hh * 256 + ll PPM.
    • Unlike the MH-Z19B, no other info is returned except the CO2 level in PPM.

0x87: Perform manual calibration immediately

  • Parameters: none.
  • Response: none.
  • Implemented by filling the measurement history with the current value and then letting the regular calibration do its magic.

0xC1: Configure

  • With p1 set to 0x13 - 0x22: store 16 bit value in p4/p5 in the specific register. We haven't figured any of these out yet.
  • With p1 set to 0x32: commit to flash
  • With p1 set to 0xAA and p2 set to 0x00: set operation mode to 0
  • With p1 set to 0xAA and p2 set to 0x01: set operation mode to 3

0xC2: Set operation mode to 1

  • Parameters: none.
  • Response: none.

0xC3: Set operation mode to 2

  • Parameters: none.
  • Response: none.

0xC4: Dump raw measurement

  • Parameters: none.
  • Response: 5D 00 00 00 01 v1 v1 v1 v1 v2 v2 v2 v2 v3 v3 v3 v3 cs
    • Dumps three 32 bit values, no idea what they are, but we're assuming they're raw sensor values.

0xC5: Same as 0x86

See 0x86.

Operation modes

  • 0: Seems to be the same as 3.
  • 1: Continuous PPM output on serial as if command 0x86 was given continuously.
  • 2: Continuous raw diarrhea mode, keeps sending lots of debug(?) data without checksums.
  • 3: Poll mode (default)

Checksum

Same as MH-Z19B.