RevSpace - User contributions [en-gb]

MH-Z19B

2019-10-01T22:53:28Z

Disasm:

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Completed
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[4] - (temperature in C) + 40
r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3..4] || r[2..3]=b[3..4] || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || Reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || Changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || Reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range. Note that parameter bytes differ from those in the datasheet.
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || Returns sensor range (r[2..5])
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x9F || b[3] || ACK || ???
|-
| 0xA0 || || r[2..5] || Firmware version string? "0430" and "0443" observed
|-
| 0xA1 || b[3] || ACK || ???
|-
| 0xA2 || b[3] || r[2], r[3..6] || ???
|-
| 0xA3 || || r[2..3] || ???
|-
| 0xA4 || b[3..4], b[5..6] || r[2] || Setting bounds for DAC output, r[2]==1 on success
|-
| 0xA5 || || r[2..3], r[4..5] || Reading bounds for DAC output
|-
| 0xAA || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAB || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAC || b[3] || r[2], r[3..6] || ???
|}

MHZ19

2019-10-01T22:52:58Z

Disasm: Add link to MH-Z19B

{{Project
|Name=MHZ19
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19 CO2 sensor
|Status=Completed
|Contact=bertrik
}}

== Introduction ==
This page is about the MH-Z19 CO2 sensor and some experiments done with it.

This sensor gives a digital (serial) output of the CO2 concentration in air, in parts-per-million (ppm).
It uses the optical measurement principle of measuring CO2, which should be much more accurate than the inexpensive electro-chemical sensors you can find.
As far as I know, the optical measurement principle uses a broadband light-source to send some light through an air-sample.
The sensor then looks at the relative intensity of the light at two different frequencies.
The CO2 gas inside the air absorbs light strongly at very specific wavelengths, allowing a determination of the concentration (ppm) of CO2.
This is then compensated for temperature (and pressure?) for increased accuracy.
See also [https://en.wikipedia.org/wiki/Nondispersive_infrared_sensor wikipedia] for this measurement principle.
A new measurement is started every 5 seconds, you can actually see a small amount of light coming out of the sensor while it's measuring.

The MH-Z19 is the cheapest optical CO2 sensor I could find on AliExpress, about E22,-.


UPDATE:
See also [https://geektimes.ru/post/285572/ this page on geektimes.ru] that explains some of the mysteries around this sensor that I didn't figure out.


See also: [[MH-Z19B]]

== Status ==
The sensor works as intended, some software has been written to read the CO2 level and publish measurements it on MQTT.
It is also clear how to change the measurement range from 0-2000ppm to 0-5000ppm in software.

Currently, it's running in Space3, publishing its value on a topic on MQTT, you can read this as follows:
mosquitto_sub -h revspace.nl -t revspace/sensors/co2/# -v

See also https://revgraph.bewaar.me/dashboard/db/all-co2

Next steps:
* play a bit more with the MH-Z19B commands and document what works and what doesn't.
* in particular, look at the alarm output (officially this output is not supported) and try to find if it is possible to set the alarm limit setting. The alarm output seems to toggle low/high on reboot of the sensor, so at least the required hardware to pull it low / high is present inside the sensor module.
* figure out what the unknown value is that comes out of the sensor.

== Hardware and reference data ==
See [http://www.winsen-sensor.com/products/ndir-co2-sensor/mh-z19.html the manufacturer MH-Z19 page].

[https://forum.mysensors.org/topic/7761/mh-z19-teardown/2 Here's a teardown] of the MH-Z19 showing what it actually looks like inside.
Basically a light source and curved mirror focusing the light onto a photo diode with an optical filter tuned to a CO2 peak.
It has an STM32F103 processor inside, the same kind as the one on the famous 'blue pill' board.

== Software ==
See [https://github.com/bertrik/mhz19 this github repo] for code using this sensor with an ESP8266 board (WeMos D1 mini).
It publishes the CO2 concentration to a MQTT topic every 5 seconds.

To connect the Wemos to the MHZ19:
* GND to both the Wemos and MHZ19 GND pin
* 5V to the Wemos +5V pin and MHZ19 Vin pin
* Wemos D1 pin to the MHZ19 TX pin
* Wemos D2 pin to the MHZ19 RX pin

It seems that support for this sensor was recently added to [https://www.esp8266.nu/index.php/ESPEasy ESPEasy].

== Setting the measurement range ==
The following command sequences can be used to configure the measurement range of the sensor:

* 1000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x03, 0xE8, 0x7B
* 2000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x07, 0xD0, 0x8F
* 3000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x0B, 0xB8, 0xA3
* 5000 ppm range: 0xFF, 0x01, 0x99, 0x00, 0x00, 0x00, 0x13, 0x88, 0xCB

== Experimentation ==
Normally, this sensor is read out using a command/response sequence over serial (9600,8N1).
The following commands are known from the datasheet:
* 0x86: gas concentration reading
* 0x87: calibrate zero point, I advise to AVOID SENDING THIS COMMAND, unless you know exactly what you are doing
* 0x88: calibrate span point, I advise to AVOID SENDING THIS COMMAND, unless you know exactly what you are doing

The MH-Z19B datasheet additionally mentions to following commands:
* 0x79: ABC logic on/off (ABC = automatic baseline correction)
* 0x99: Sensor detection range setting, this command can be used to set the measurement range (e.g. 0-2000ppm or 0-5000ppm)
It appears that these commands work on the MH-Z19 too, although with a little different command layout.
Specifically, the range for command 0x99 is not put into bytes 3/4 but in bytes 6/7 of the command.

This paragraph describes some experiments done to discover other commands than the ones mentioned in the datasheet.
=== command 0x00-0x30 ===
No response.

=== command 0x31-0x6F ===
Untested.

=== command 0x62 (device name / id) ===
According to the information at https://geektimes.ru/post/285572/
this command should return a kind of string, I couldn't get this to work unfortunately
<s>
Command 0x62 seems to query the sensor for a device name, either "KB200" or "MODBUS"
</s>

=== command 0x70 ===
This command gives a response as follows:
<pre>
9F 83 07 7D 00 00
</pre>
The value 0x9F83 (40835 in decimal) looks similar to the output of command 0x84.

The value 0x077d (1917 in decimal) looks similar to the output of command 0x85.

=== command 0x71, 0x72 ===
These commands give a response as follows:
<pre>00 00 00 00 00 00</pre>

=== command 0x73 ===
<pre>9F 86 00 00 3D 40</pre>
0x9F86 = 40838 decimal, looks similar to output of command 0x84.
0x3d40 = 15680 decimal.

<pre>07 8C 00 00 3D 04</pre>
* 0x078c = 1932 decimal
* the 0x3D is temperature I think
* the 0x04 is the 'status' byte

=== command 0x80 - 0x83 ===
No response.
=== command 0x84 ===
This command gives a response as follows:
<pre>9F 88 00 00 00 00</pre>
The 0x88 byte seems to go up and down a bit.

Some other time
<pre>9F A1 00 80 00 00</pre>

=== command 0x85 (read CO2 + alarm level?) ===
This command gives a response as follows:
<pre>
07 7D 01 D5 27 10
</pre>
The 0x1D5 value is the same as the CO2 concentration reading from command 0x86!
0x077D is equivalent to 1917 decimal.
0x2710 is equivalent to 10000 decimal exactly.

Perhaps the 0x2710 value is the alarm value?

=== Command 0x86 (read concentration) ===
Command 0x86 is the command to send to just read out the most recent ppm value.

A response to command 0x86 typically looks like this:
<pre>
0xFF CM HH LL TT SS Uh Ul CS
</pre>
where
* CM is the command repeated back
* HH/LL is the CO2 ppm value, high/low part
* TT is the temperature in degrees Celcius, plus 40. For example, when temperature is 25 deg C, then TT = 0x41
* SS is some kind of status byte, this byte always has only one bit set!
* Uh/Ul is some unknown value, perhaps related to pressure? After booting the sensor, it starts out at 15000 exactly, then typically settles to about 10500.
According to the geektimes.ru page, this unknown value is related to the minimum CO2 uncorrected concentration measured in the past day. So I guess this is a relevant parameter from the ABC-algorithm.
* Cs is the checksum

Values TT, SS and Uh/Ul are undocumented.

=== command 0x89-0x8F ===
No response is returned, however command 0x8d seems to reset the sensor.

=== command 0x99 (range) ===
According to the MH-Z19B datasheet, you can configure the measurement range by putting the desired range in byte 3 and 4.
However, unlike what the MH-Z19B datasheet says, you can set the range using the following command (in this case 0x07d0 = 2000 ppm in byte 6 and 7):
<pre>
0xFF 0x01 0x99 0x00 0x00 0x00 0x07 0xD0 0x8F
<cmd> ^-range-^
</pre>

Experimenting a bit:
Sending all zeros gives a response of
<pre>01 00 00 00 00 00</pre>

== Log of MH-Z19 response at startup ==
Below is a log of the sensor response to the 0x86 measurement command while starting up.
The first couple of measurement seem to be invalid.

<pre>
HH LL TT SS U1 U2
RAW: 00 80 47 01 3A 98 -> CO2 = 128 ppm
RAW: 07 D0 47 01 3A 98 -> 0x7d0 = 2000 decimal, this is the configured measurement range of the sensor with command 0x99
RAW: 00 05 47 01 3A 98 -> CO2 = 5 ppm
RAW: 01 2D 47 01 3A 98 -> CO2 = ..
RAW: 28 97 47 01 3A 98 -> CO2 = 10391
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 01 3A 98
RAW: 28 97 47 40 3A 98
RAW: 28 97 47 40 3A 98
RAW: 03 84 47 40 2B 43 -> first sample with U different from 0x3a98 (15000 decimal)
RAW: 03 85 47 40 2B 19
RAW: 03 86 47 40 2A F9
RAW: 03 87 47 40 2A E1 -> CO2 = 903 ppm, T = 31 deg C, Status = 0x40, Unknown = 10977
</pre>

The first measurement shows a ppm value of 128, a temperature of 31 degrees C, a "status" byte of 01 and the "unknown" value of 0x3a98 (= 15000).
The second measurement shows a high ppm value of 2000 ppm (the max value within the ppm range).
The third measurement shows a low ppm value of 5 ppm.
The fourth measurement shows a ppm value of 301 ppm.
The fifth measurement shows a very high ppm value of 10391.
The final measurement shows a realistic indoors ppm value of 0x387 = 903 ppm.
The "unknown value" (byte 4/5) typically settles down to 10500 or so.

So, it takes some time before the measurement stabilizes, proposed heuristic for a valid reading:
* "status byte" has to be 0x40
* "unknown value" has to be lower than 15000

MH-Z19B

2019-10-01T22:51:44Z

Disasm: /* Protocol (operation mode 0) */

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[4] - (temperature in C) + 40
r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3..4] || r[2..3]=b[3..4] || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || Reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || Changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || Reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range. Note that parameter bytes differ from those in the datasheet.
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || Returns sensor range (r[2..5])
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x9F || b[3] || ACK || ???
|-
| 0xA0 || || r[2..5] || Firmware version string? "0430" and "0443" observed
|-
| 0xA1 || b[3] || ACK || ???
|-
| 0xA2 || b[3] || r[2], r[3..6] || ???
|-
| 0xA3 || || r[2..3] || ???
|-
| 0xA4 || b[3..4], b[5..6] || r[2] || Setting bounds for DAC output, r[2]==1 on success
|-
| 0xA5 || || r[2..3], r[4..5] || Reading bounds for DAC output
|-
| 0xAA || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAB || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAC || b[3] || r[2], r[3..6] || ???
|}

MH-Z19B

2019-10-01T22:49:29Z

Disasm: /* Protocol (operation mode 0) */

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3..4] || r[2..3]=b[3..4] || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || Reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || Changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || Reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range. Note that parameter bytes differ from those in the datasheet.
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || Returns sensor range (r[2..5])
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x9F || b[3] || ACK || ???
|-
| 0xA0 || || r[2..5] || Firmware version string? "0430" and "0443" observed
|-
| 0xA1 || b[3] || ACK || ???
|-
| 0xA2 || b[3] || r[2], r[3..6] || ???
|-
| 0xA3 || || r[2..3] || ???
|-
| 0xA4 || b[3..4], b[5..6] || r[2] || Setting bounds for DAC output, r[2]==1 on success
|-
| 0xA5 || || r[2..3], r[4..5] || Reading bounds for DAC output
|-
| 0xAA || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAB || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAC || b[3] || r[2], r[3..6] || ???
|}

MH-Z19B

2019-10-01T22:45:42Z

Disasm: /* Protocol (operation mode 0) */

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3..4] || r[2..3]=b[3..4] || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range. Note that parameter bytes differ from those in the datasheet.
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || r[2..5] - sensor range
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x9F || b[3] || ACK || ???
|-
| 0xA0 || || r[2..5] || Firmware version string? "0430" and "0443" observed
|-
| 0xA1 || b[3] || ACK || ???
|-
| 0xA2 || b[3] || r[2], r[3..6] || ???
|-
| 0xA3 || || r[2..3] || ???
|-
| 0xA4 || b[3..4], b[5..6] || r[2] || Setting bounds for DAC output, r[2]==1 on success
|-
| 0xA5 || || r[2..3], r[4..5] || Reading bounds for DAC output
|-
| 0xAA || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAB || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAC || b[3] || r[2], r[3..6] || ???
|}

MH-Z19B

2019-10-01T17:13:22Z

Disasm: /* Protocol (operation mode 0) */

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3..4] || r[2..3]=b[3..4] || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || r[2..5] - sensor range
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x9F || b[3] || ACK || ???
|-
| 0xA0 || || r[2..5] || Firmware version string? "0430" and "0443" observed
|-
| 0xA1 || b[3] || ACK || ???
|-
| 0xA2 || b[3] || r[2], r[3..6] || ???
|-
| 0xA3 || || r[2..3] || ???
|-
| 0xA4 || b[3..4], b[5..6] || r[2] || Setting bounds for DAC output, r[2]==1 on success
|-
| 0xA5 || || r[2..3], r[4..5] || Reading bounds for DAC output
|-
| 0xAA || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAB || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAC || b[3] || r[2], r[3..6] || ???
|}

MH-Z19B

2019-10-01T17:07:19Z

Disasm: /* Protocol (operation mode 0) */

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3] || ??? || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || r[2..5] - sensor range
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x9F || b[3] || ACK || ???
|-
| 0xA0 || || r[2..5] || Firmware version string? "0430" and "0443" observed
|-
| 0xA1 || b[3] || ACK || ???
|-
| 0xA2 || b[3] || r[2], r[3..6] || ???
|-
| 0xA3 || || r[2..3] || ???
|-
| 0xA4 || b[3..4], b[5..6] || r[2] || Setting bounds for DAC output, r[2]==1 on success
|-
| 0xA5 || || r[2..3], r[4..5] || Reading bounds for DAC output
|-
| 0xAA || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAB || b[3], b[4] || r[2], r[3] || ???
|-
| 0xAC || b[3] || r[2], r[3..6] || ???
|}

MH-Z19B

2019-10-01T16:59:20Z

Disasm: /* Protocol (operation mode 0) */

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

Datasheet: https://www.winsen-sensor.com/d/files/infrared-gas-sensor/mh-z19b-co2-ver1_0.pdf

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

== Operation ==

Firmware turns on lamp for 400 ms and measures sensor response along with the voltage of the voltage reference. This happens again and again in cycle. Default cycle length is 5s.

[[File:MH-Z19B-operation.png]]

Firmware measures only a part of the response signal: 180..980 ms interval in 10ms steps. It integrates 180..680 ms interval and removes constant component (1.026V on the image above) based on values from the 930..980 ms interval. Obtained result after some smoothing is available (divided by 2) via command 0x84. This value is used for subsequent computations.

Another firmware turns on lamp for 500 ms and measures 450..500 ms and 1800..1850 ms intervals, then uses the second one to remove constant component from the first one.

As stated in the datasheet, MH-Z19B should be kept away from heat. Experiment showed that the light sensor inside MH-Z19B stops working when MH-Z19B is exposed to an air stream from a heat gun.

[[File:MH-Z19B-heating.png]]

== Interface ==

Sensor provides UART, PWM and analog output interfaces. Both PWM and analog output provide CO2 measurement result limited by some bounds.
UART interface implements one of several protocols. Default protocol ("operation mode 0") is the richest one.

=== Protocol (operation mode 0) ===

All commands and responses are 9 bytes in size. Most of the commands have a response, but some -- don't. Response contains command code, both command and response contain checksum value.

Command format: 0xFF, 0x01, CMD, (5 bytes of parameters), CKSUM

Response format: 0xFF, CMD, (6 bytes of response), CKSUM

For short, hereinafter this response will be called "ACK": 0xFF, CMD, '''0x01''', 0x00, 0x00, 0x00, 0x00, 0x00, CKSUM

In the following table in Request and Response fields only the meaningful bytes will be shown.
For example, b[3] is the first parameter byte and b[3..4] is the first two parameter bytes forming a word. "???" means "isn't investigated yet", an empty field means "no parameters".

{| class="wikitable"
|-
! Command !! Request !! Response !! Description
|-
| 0x78 || b[3] || no response || Changes operation mode and performs MCU reset
|-
| 0x79 || b[3] || ACK || Turns ABC logic on or off (b[3] == 0xA0 - on, 0x00 - off)
|-
| 0x7D || || r[7] || Returns ABC logic status (1 - enabled, 0 - disabled)
|-
| 0x7E || b[3], b[4..5] || r[2..3] || Sets timer cycle length (b[4..5]) in seconds and returns current value. b[3] should be 2 to update the length
|-
| 0x80..0x83 || b[3], b[4..7] || no response || Writes one double word to the 1024-byte configuration area (offset = b[3] + (CMD - 0x80) * 256).
Command 0x80 with b[3]==0 clears the whole configuration area. On timeout this configuration area will be written to flash.
|-
| 0x84 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. r[2..3] is a half of the raw light sensor value. r[4..5] is constant 32000.
r[6..7] is different in different versions of firmware: bit field or maximum light ADC value
|-
| 0x85 || || r[2..3], r[4..5], r[6..7] || Returns "raw" values. b[2..3] is smoothed temperature ADC value. b[4..5] is CO2 level before clamping.
b[6..7] is minimum light ADC value
|-
| 0x86 || || r[2..3], r[4], r[5], r[6], r[7] || r[2..3] - "final" CO2 level. r[6] and r[7] - if ABC turned on - counter in "ticks" within a calibration cycle and the number of performed calibration cycles.
|-
| 0x87 || b[5], b[6], b[7] || r[2], r[3..6] || ???
|-
| 0x88 || b[3] || ??? || ???
|-
| 0x8D || || no response || MCU reset
|-
| 0x90..0x93 || b[3] || r[2..5] || reads a double word from configuration area by offset (b[3] + (CMD - 0x90) * 256)
|-
| 0x94 || b[3], b[4..6] || r[2..6] || changes 3 bytes (b[4..6]) of "id string" with offset (3*(b[3] - 1))
|-
| 0x95 || b[3] || r[2], r[3], r[4..6] || reads 3 bytes of "id string" (b[4..6]) with offset
|-
| 0x99 || b[4..7] || ACK || Sets sensor range
|-
| 0x9A || b[4] || ACK || ???
|-
| 0x9B || || r[2..5], r[6], r[7] || r[2..5] - sensor range
|-
| 0x9C || || r[2..5], r[6]=1 || ???
|-
| 0x?? || ??? || ??? ||
|-
| 0x?? || ??? || ??? ||
|-
| 0x?? || ??? || ??? ||
|}

MH-Z19B

2019-10-01T16:12:38Z

Disasm: /* Operation */

MH-Z19B

2019-10-01T16:11:13Z

Disasm:

File:MH-Z19B-heating.png

2019-10-01T16:09:11Z

Disasm:

MH-Z19B heating response

MH-Z19B

2019-10-01T16:01:04Z

Disasm:

File:MH-Z19B-operation.png

2019-10-01T15:31:59Z

Disasm:

MH-Z19B signals (lamp and light sensor)

MH-Z19B

2019-10-01T15:13:30Z

Disasm:

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

Partial schematics:

[[File:MH-Z19B-schematics.png|800px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

File:MH-Z19B-schematics.png

2019-10-01T15:11:59Z

Disasm:

MH-Z19B schematics

MH-Z19B

2019-10-01T14:32:08Z

Disasm:

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Teardown ==

Back side of the MH-Z19B sensor with unlabeled SWD pads on the right:

[[File:MH-Z19B-back.jpg|400px]]

Front side of the (4-layer) PCB:

[[File:MH-Z19B-pcb.jpg|400px]]
[[File:MH-Z19B-pcb-markings.jpg|400px]]
[[File:MH-Z19B-pcb-tracks.jpg|400px]]

== Firmware ==

MCU firmware can be easily dumped through SWD pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

File:MH-Z19B-pcb-tracks.jpg

2019-10-01T14:30:17Z

Disasm:

MH-Z19B PCB tracks

File:MH-Z19B-pcb-markings.jpg

2019-10-01T14:28:12Z

Disasm:

MH-Z19B PCB markings

File:MH-Z19B-pcb.jpg

2019-10-01T14:25:49Z

Disasm:

MH-Z19B PCB front side

MH-Z19B

2019-10-01T14:00:33Z

Disasm:

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Firmware ==

[[File:MH-Z19B-back.jpg|thumb|Back side of the MH-Z19B sensor with unlabeled SWD pads on the right]]

MCU firmware can be easily dumped through SWD test pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

File:MH-Z19B-back.jpg

2019-10-01T13:57:51Z

Disasm:

Back side of the MH-Z19B sensor

MH-Z19B

2019-10-01T13:52:18Z

Disasm:

{{Project
|Name=MH-Z19B
|Picture=mhz19.jpg
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}

== Introduction ==

MH-Z19B is an updated version of the [[MHZ19|MH-Z19]] sensor.

== Hardware ==

* STM32F051K86 MCU
* Unknown analog light+temperature sensor
* Two 3.3V regulators
* 1.5V voltage reference
* Lamp

== Firmware ==

MCU firmware can be easily dumped through SWD test pads. Pinout:

{| class="wikitable"
|-
! Pin !! Signal
|-
| 1 (square) || 3V3
|-
| 2 || GND
|-
| 3 || SWDIO
|-
| 4 || SWCLK
|-
| 5 || RESET (active low)
|}

Additionally, bootloader asks for a firmware update during the first 20s of startup.

MH-Z19B

2019-10-01T13:18:02Z

Disasm: Created page with " {{Project |Name=MH-Z19B |Omschrijving=Some research into the MH-Z19B CO2 sensor |Status=Initializing |Contact=Disasm }}"

{{Project
|Name=MH-Z19B
|Omschrijving=Some research into the MH-Z19B CO2 sensor
|Status=Initializing
|Contact=Disasm
}}