CO2MeterHacking

Project CO2MeterHacking
Status	Completed
Contact	bertrik
Last Update	2016-08-14

status: it works

We found out that the G, C, D, V signals are routed internally to the RJ45-plug (but we didn't document which signal goes to which pin ...), so there's actually no need to open the CO-100 and solder a connector on the G, C, D, V lines.

Introduction

This project is about hacking the Voltcraft CO-100 CO₂-sensor, such that we can read the exact ppm value as displayed on the LCD.

This particular CO₂-sensor is present in the klusbunker at RevSpace and is currently used to control the ventilation in a crude manner (by monitoring the warning LEDs on the display module). Having the CO₂ ppm value available as a number allows for nice things such as logging the levels over time, announce them on IRC, show them on the LedBanner , etc.

The user manual of the Voltcraft CO-100 says "Achtung! Der RJ45-Anschluss (siehe Kapitel 7, Position „K“) darf nicht verwendet werden. Der Anschluss ist nur für den Hersteller vorgesehen." Of course, a claim like that can only be interpreted as a challenge! :)

Investigation & findings

CO-100 internals

The CO₂ sensor inside the CO-100 (in the left of the picture) has a sticker saying ZGw063RY. Googling for this number reveals a CO₂ module that looks just like the Voltcraft CO-100, so it appears that the CO-100 is basically a rebranded ZyAura ZGw063RY module.

The CO-100 seems to miss a bunch of components that can be mounted on the PCB, close to the RJ45 connection (most likely an RS232 chip with charge pump capacitors).

components around the RJ45 connector

The CO₂ sensor in the CO-100 is a ZyAura ZG-01 module. This sensor uses the ZyAura protocol, which vaguely resembles SPI, see File:ZyAura CO2 Monitor Carbon Dioxide ZG01 Module english manual-1.pdf.

On the bottom left of the PCB is a set of pads that are marked with G, C, D, V, meaning Ground, Clock, Data, Voltage of the ZG01 sensor. The voltage level on the clock and data pins is 3.3V (the voltage on V pin is 3.3V too).

The ZG-01 sends 5-byte frames containing measurement values:

• byte 0 is an identifier for the measurement item, e.g. whether it is a CO₂ ppm value or a temperature.
• byte 1 and 2 contain the value of the item (byte 1 is the MSB, byte 2 is the LSB)
• byte 3 is a checksum over bytes 0-2, just the sum modulo 256.
• byte 4 is always 0x0D

Besides the CO₂ ppm value and temperature, it also sends various other (so far unknown) measurement items.

Measurement items encountered so far:

Item	Value	Remark
0x41 'A'	3290	Relative humidity in units of 0.01%
0x42 'B'	4708	Temperature in Kelvin (unit of 1/16th K)
0x43 'C'	2964	?
0x46 'F'	6882	Temperature in degrees Fahrenheit (unit of 0.01)?
0x4F 'O'	7754	?
0x50 'P'	857	CO2 concentration in ppm
0x52 'R'	10438	Barometric pressure?
0x56 'V'	10443	Barometric pressure?
0x57 'W'	7880	?
0x6D 'm'	2559	Seems to always have same value
0x6E 'n'	17146	?
0x71 'q'	855	Always close to value of item 0x50

Integration into Revspace infrastructure

Measurements of the CO₂ meter are integrated into the existing infrastructure as follows:

• The G, C, D, V lines from the ZG-01 have been broken out using a standard 2.54mm pitch header
• The ZG-01 ground, clock and data lines are attached to an arduino which decodes the ZG-01 protocol
• Also attached to the arduino is an NRF24L01+ wireless transceiver, through which the CO₂ measurement is sent to a central receiver (the one that also handles the Nomz-bell, Skip-button, etc.).

Hardware

The ZG-01 module and NRF24L01+ transceiver are connected to the Arduino as follows:

Arduino	Module	Remark
D2	ZG-C	ZG01 clock signal
D3	ZG-D	ZG01 data signal
GND	NRF-1, ZG-G	NRF ground, ZG01 ground
3V3	NRF-2	NRF power
D8	NRF-3	NRF CE
D9	NRF-4	NRF CSN
D13	NRF-5	NRF SCK
D11	NRF-6	NRF MOSI
D12	NRF-7	NRF MISO
-	8	NRF IRQ - not connected

Software

The basic function of the software on the arduino is to wait until a CO₂ measurement is received from the ZG-01, then send it using the wireless transceiver.

The source code can be found on github.

ZG-01 decoding

The ZG-01 protocol is decoded using a simple state machine. On each falling edge of the clock line, a sample of the data line is taken until a total of 40 bits is received. If the time between a bit and the previous bit is longer than 2 milliseconds, it is assumed that a new 5-byte frame has started.

Wireless protocol

To control the NRF24L01+ wireless transceiver, we use the gcopeland fork of the RF24 library. This library has several important fixes over the original RF24 library (and is used in the receiver as well).

The wireless message consist of 7 bytes:

• 0x06 "CO_2" <MSB> <LSB> for the CO₂ concentration message (in ppm)
• 0x06 "HUMI" <MSB> <LSB> for the relative humidity message (in units of 0.01%)

Heat map generation

Flok420 is generating heat maps. keetweej.vanheusden.com/revspace/co2.php He also has a large data set you might be able to use for your own data-mining purpose.