AQC-0-0-0-0
| Project AQC-0-0-0-0 | |
|---|---|
| |
| Reverse engineering a CO2 sensor | |
| Status | In progress |
| Contact | Sebastius, Xesxen, Juerd |
| Last Update | 2021-01-05 |
The AQC-0-0-0-0 is a CO2 sensor, much like the MH-Z19B. We have no idea who makes these and where they can be bought, but it's an aesthetically pleasing device that seems to work at least as well as the famous MH-Z19B. It has the same form factor and is pin compatible. Regarding the protocol it is only compatible with the MH-Z19 for the commands 0x86 and 0x87.
The sensor communicates using 5V-tolerant 3.3V TTL serial, 9600 8N1.
Since the datasheet is lacking in instructions on how to use it, and information about the sensor couldn't be found online anywhere, we've tried to reverse-engineer the device to figure out the protocol.
Teardown
Bottom of PCB, as visible without destroying the sensor
Top of PCB (inside)
Case removed
Protocol
- Query: id 01 cc p1 p2 p3 p4 p5 cs
| id | Device BUS id? Is 0xFF for our device, but seems variable. |
| cc | Command (e.g. 0x86) |
| px | Parameters, left at 00 when there are none |
| cs | Checksum |
Commands
0x86 or 0xC5: Request CO2 level
- Parameters: none.
- Response: FF 86 hh ll 00 00 00 00 cs, where the CO2 level is hh * 256 + ll PPM.
- Unlike the MH-Z19B, no other info is returned except the CO2 level in PPM.
0x87: Perform manual calibration immediately
- Parameters: none.
- Response: none.
- Implemented by filling the measurement history with the current value and then letting the regular calibration do its magic.
0xC1: Configure
- With p1 set to 0x13 - 0x22: store 16 bit value in p4/p5 in the specific register. We haven't figured any of these out yet.
- With p1 set to 0x32: commit to flash
- With p1 set to 0xAA and p2 set to 0x00: set operation mode to 0
- With p1 set to 0xAA and p2 set to 0x01: set operation mode to 3
0xC2: Set operation mode to 1
- Parameters: none.
- Response: none.
0xC3: Set operation mode to 2
- Parameters: none.
- Response: none.
0xC4: Dump raw measurement
- Parameters: none.
- Response: 5D 00 00 00 01 v1 v1 v1 v1 v2 v2 v2 v2 v3 v3 v3 v3 cs
- Dumps three 32 bit values, no idea what they are, but we're assuming they're raw sensor values.
0xC5: Same as 0x86
See 0x86.
Operation modes
- 0: Seems to be the same as 3.
- 1: Continuous PPM output on serial as if command 0x86 was given continuously.
- 2: Continuous raw diarrhea mode, keeps sending lots of debug(?) data without checksums.
- 3: Poll mode (default)
Checksum
Same as MH-Z19B.