AQC-0-0-0-0

Project AQC-0-0-0-0
Reverse engineering a CO2 sensor
Status	In progress
Contact	Sebastius, Xesxen, Juerd
Last Update	2021-01-05

The AQC-0-0-0-0 (top) in use in an Operame CO2-meter with a TTGO T-Display showing the current CO2 level in PPM.

The AQC-0-0-0-0 is a CO2 sensor, much like the MH-Z19B. We have no idea who makes these and where they can be bought, but it's an aesthetically pleasing device that seems to work at least as well as the famous MH-Z19B. It has the same form factor and is pin compatible. Regarding the protocol it is only (somewhat) compatible with the MH-Z19 for the commands 0x86 and 0x87.

The sensor communicates using 5V-tolerant 3.3V TTL serial, 9600 8N1.

Since the datasheet is lacking in instructions on how to use it, and information about the sensor couldn't be found online anywhere, we've tried to reverse-engineer the device to figure out the protocol.

Teardown

• 

  Bottom of PCB, as visible without destroying the sensor

• 

  Top of PCB (inside)

• 

  Case removed

Datasheet

• File:AQC系列红外CO2传感器 - V4.0.pdf - AQC series infrared CO2 sensor datasheet in Chinese

There's a very similar thing with "HCC" instead of "AQC"; datasheets found at http://down.cosou.com/tsmartsensor.com/

• File:HCC系列红外CO2传感器 v2.1.pdf - HCC series infrared CO2 sensor datasheet in Chinese
• File:HCC series infrared CO2 sensor v2.1.pdf - HCC series infrared CO2 sensor datasheet in English

The HCC sensors have a different baud rate and different initial byte in the protocol. Other than that they appear to be the same thing. Like the AQC series sensors, it doesn't seem to be for sale online anywhere.

Protocol

• Query: id 01 cc p1 p2 p3 p4 p5 cs
• Example: FF 01 C5 00 00 00 00 00 3A

id	Device bus id? Is 0xFF for our device, but seems variable.
cc	Command (e.g. 0x86)
px	Parameters, left at 00 when there are none
cs	Checksum

Commands

0x86 or 0xC5: Request CO2 level

• Parameters: none.
• Response: FF 86 hh ll 00 00 00 00 cs, where the CO2 level is hh * 256 + ll PPM.
  • Unlike the MH-Z19B, no other info is returned except the CO2 level in PPM.

0x87: Perform manual calibration immediately

• Parameters: none.
• Response: none.
• Implemented by filling the measurement history with the current value and then letting the regular calibration do its magic.

0xC1: Configure

• With p1 set to 0x13 - 0x22: store 16 bit value in p4/p5 in the specific register. We haven't figured any of these out yet.
• With p1 set to 0x32: commit to flash
• With p1 set to 0xAA and p2 set to 0x00: set operation mode to 0
• With p1 set to 0xAA and p2 set to 0x01: set operation mode to 3

0xC2: Set operation mode to 1

• Parameters: none.
• Response: none.

0xC3: Set operation mode to 2

• Parameters: none.
• Response: none.

0xC4: Dump raw measurement

• Parameters: none.
• Response: 5D 00 00 00 01 v1 v1 v1 v1 v2 v2 v2 v2 v3 v3 v3 v3 cs
  • Dumps three 32 bit values, no idea what they are, but we're assuming they're raw sensor values.

0xC5: Same as 0x86

See 0x86.

Operation modes

• 0: Seems to be the same as 3.
• 1: Continuous PPM output on serial as if command 0x86 was given continuously.
• 2: Continuous raw diarrhea mode, keeps sending lots of debug(?) data without checksums.
• 3: Poll mode (default)

Checksum

Same as MH-Z19B.