From RevSpace
Revision as of 15:04, 5 January 2021 by Juerd (talk | contribs) (→‎HCC)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search
Project AQC-0-0-0-0
Reverse engineering a CO2 sensor
Status In progress
Contact Sebastius, Xesxen, Juerd
Last Update 2021-01-05
The AQC-0-0-0-0 (top) in use in an Operame CO2-meter with a TTGO T-Display showing the current CO2 level in PPM.

The AQC-0-0-0-0 is a CO2 sensor, much like the MH-Z19B. We have no idea who makes these and where they can be bought, but it's an aesthetically pleasing device that seems to work at least as well as the famous MH-Z19B. It has the same form factor and is pin compatible. Regarding the protocol it is only (somewhat) compatible with the MH-Z19 for the commands 0x86 and 0x87.

The sensor communicates using 5V-tolerant 3.3V TTL serial, 9600 8N1.

Since the datasheet is lacking in instructions on how to use it, and information about the sensor couldn't be found online anywhere, we've tried to reverse-engineer the device to figure out the protocol.





There's a very similar thing with "HCC" instead of "AQC"; datasheets found at

Unlike the AQC, the HCC have a protocol example in the datashee, but it's a slightly different protocol than the AQC (the AQC series seems to be based on the HCC, but made somewhat compatible with the MH-Z19 protocol). They also have a different baud rate (115200 instead of 9600). Other than that they appear to be the same thing. Like the AQC series sensors, it doesn't seem to be for sale online anywhere.


  • Query: id 01 cc p1 p2 p3 p4 p5 cs
  • Example: FF 01 C5 00 00 00 00 00 3A
id Device bus id? Is 0xFF for our device, but seems variable. It's 0x5C for the HCC series sensors.
cc Command (e.g. 0x86)
px Parameters, left at 00 when there are none
cs Checksum


0x86 or 0xC5: Request CO2 level

  • Parameters: none.
  • Response: FF 86 hh ll 00 00 00 00 cs, where the CO2 level is hh * 256 + ll PPM.
    • Unlike the MH-Z19B, no other info is returned except the CO2 level in PPM.

0x87: Perform manual calibration immediately

  • Parameters: none.
  • Response: none.
  • Implemented by filling the measurement history with the current value and then letting the regular calibration do its magic.

0xC1: Configure

  • With p1 set to 0x13 - 0x22: store 16 bit value in p4/p5 in the specific register. We haven't figured any of these out yet.
  • With p1 set to 0x32: commit to flash
  • With p1 set to 0xAA and p2 set to 0x00: set operation mode to 0
  • With p1 set to 0xAA and p2 set to 0x01: set operation mode to 3

0xC2: Set operation mode to 1

  • Parameters: none.
  • Response: none.

0xC3: Set operation mode to 2

  • Parameters: none.
  • Response: none.

0xC4: Dump raw measurement

  • Parameters: none.
  • Response: 5D 00 00 00 01 v1 v1 v1 v1 v2 v2 v2 v2 v3 v3 v3 v3 cs
    • Dumps three 32 bit values, no idea what they are, but we're assuming they're raw sensor values.

0xC5: Same as 0x86

See 0x86.

Operation modes

  • 0: Seems to be the same as 3.
  • 1: Continuous PPM output on serial as if command 0x86 was given continuously.
  • 2: Continuous raw diarrhea mode, keeps sending lots of debug(?) data without checksums.
  • 3: Poll mode (default)


Same as MH-Z19B.