Difference between revisions of "CO2MeterHacking"

From RevSpace
Jump to navigation Jump to search
Line 31: Line 31:
 
== Future work ==
 
== Future work ==
 
Possible further investigation:
 
Possible further investigation:
* Sniff the ZG01 SPI connection, e.g. using a bus pirate or an Arduino
+
* Sniff the ZG01 SPI connection, e.g. using a bus pirate, Arduino or a Raspberry pi
 +
** figure out if the CO2 sensor SPI message uses HEX or BCD format
 +
* Check if the pads in the lower-left of the PCB say "G C D V", that could be the Ground, Clock, Data, Vcc lines from/to the ZG-01 sensor, just like in the user manual document.
 
* Check if the empty footprint on the PCB matches a max232
 
* Check if the empty footprint on the PCB matches a max232

Revision as of 20:48, 18 March 2014

Project CO2MeterHacking
Status Initializing
Contact bertrik
Last Update 2014-03-18

Introduction

This project is about hacking the Voltcraft CO-100 CO2-sensor, such that we can read the exact ppm value as displayed on the LCD.

This particular CO2-sensor is present in the klusbunker at RevSpace and is currently used to control the ventilation in a crude manner (by monitoring the warning LEDs on the display module). Having the CO2 ppm value available as a number allows for nice things such as logging the levels over time, announce them on IRC, show them on the LedBanner , etc.

The user manual of the Voltcraft CO-100 says "Attention! The RJ45 connection (see chapter 7, item „K“) must not be used. The connection is only intended for the manufacturer". Of course, a claim like that can only be interpreted as a challenge! :)

Investigation

CO-100 internals

The CO2 sensor inside the CO-100 (in the left of the picture) has a sticker saying ZGw063RY. Googling for this number reveals a CO2 module that looks just like the Voltcraft CO-100, so it appears that the CO-100 is basically just a rebranded ZyAura ZGw063RY module.

The CO-100 seems to miss a bunch of components that can be mounted on the PCB, close to the RJ45 connection (possibly an RS232 chip with step-up capacitors).

components around the RJ45 connector

CO2 sensor

The CO2 sensor in the CO-100 looks very much like the ZyAura ZG-01 module. The ZG-01 sensor uses the SPI protocol, see the File:ZyAura CO2 Monitor Carbon Dioxide ZG01 Module english manual-1.pdf.

Other sensors on the market:

Future work

Possible further investigation:

  • Sniff the ZG01 SPI connection, e.g. using a bus pirate, Arduino or a Raspberry pi
    • figure out if the CO2 sensor SPI message uses HEX or BCD format
  • Check if the pads in the lower-left of the PCB say "G C D V", that could be the Ground, Clock, Data, Vcc lines from/to the ZG-01 sensor, just like in the user manual document.
  • Check if the empty footprint on the PCB matches a max232