{"id":238392,"date":"2021-04-29T22:00:02","date_gmt":"2021-04-29T20:00:02","guid":{"rendered":"https:\/\/emariete.com\/?p=238392"},"modified":"2023-11-25T10:52:21","modified_gmt":"2023-11-25T09:52:21","slug":"destripe-teardown-ingenieria-inversa-medidor-co2-particulas-dm306-ws1125","status":"publish","type":"post","link":"https:\/\/emariete.com\/en\/destripe-teardown-ingenieria-inversa-medidor-co2-particulas-dm306-ws1125\/","title":{"rendered":"Teardown and Reverse Engineering CO\u2082 and Particulate Matter Meter DM306 \/ WS1125"},"content":{"rendered":"

<\/p>\n\n\n\n

After doing the initial analysis it was time to do what I really bought the DM306 for. Gut it!<\/strong><\/p>\n\n\n\n

Curiosity kills me, and I need to know<\/strong> what's inside and how it's made.<\/p>\n\n\n\n

In case you haven't read the previous article with the analysis (I recommend you do so) we talked about this meter:<\/p>\n\n\n\n

No products found.<\/p><\/p>\n\n\n\n

The dismantling, dismantling or \"teardown\" of the CO2 meter<\/h2>\n\n\n\n

Opening the meter<\/h3>\n\n\n\n

One of the main objectives of buying this meter was precisely to be able to open it and investigate how it was made and to get to know its components, especially its sensors<\/strong>We were able to find out what we could expect from it and what hacking possibilities there were.<\/p>\n\n\n\n

Opening it is not very easy.<\/strong> Under the front of the screen, which is glued to the case, there are four screws that have to be removed and removing the front is a bit scary because it is well glued and gives the feeling that it is going to break.<\/p>\n\n\n\n

When you start to take off, you don't know exactly how it's mounted either, so you're even more afraid, thinking that you might damage the screen.<\/p>\n\n\n\n

Finally you realise that the screen is not attached to the front, but is instead attached with a double-sided adhesive tape<\/strong>The screen is not in danger by removing it carefully and it is more a problem of not spoiling the aesthetic aspect of the case. In my case I did it with a cutter and patience<\/strong>by cutting the adhesive and prying it off.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Once you have removed the front, you can remove the four screws and the box opens like a shell in two halves without any problem.<\/p>\n\n\n\n

When separating the two halves of the box, care must be taken to separate the two halves because we have elements glued on both sides<\/strong>The main board is on the front panel and the particle sensor, temperature sensor and battery on the rear. The main board is at the front and the particle sensor, temperature sensor and battery are at the rear.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Care must be taken with these cables, especially the temperature sensor, because it has some very thin cables<\/strong>The sensor is taped with double-sided tape next to the vents and needs to be peeled off to separate the two parts. The sensor is taped with double-sided tape next to the vents and needs to be peeled off in order to separate the two parts of the case, which is not too difficult.<\/p>\n\n\n\n

Structure and components <\/h3>\n\n\n\n

The structure of the meter is quite simple and, if we follow the board clockwise from the micro USB port, we find:<\/p>\n\n\n\n

Battery charger<\/h4>\n\n\n\n

The battery charger is built around a not very well known ETA6002 integrated circuit.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

One positive thing about this chip is that it incorporates a feature called \"Power Path\" which allows the meter to operate while the battery is charging and to do so without putting the battery and charger at risk, unlike other devices.<\/p>\n\n\n\n

Although the chip allows a charging current of 2.5A it seems to be regulated to about 1A, which is quite good and a good compromise between charging speed and battery longevity.<\/p>\n\n\n\n

https:\/\/datasheetspdf.com\/datasheet\/ETA6002.html<\/a><\/p>\n\n\n\n

Power supply<\/h4>\n\n\n\n

Next, we have a section containing the power supply, or more precisely, the power supplies.<\/p>\n\n\n\n

Power to the meter can be from a micro USB or from the battery, which means that the supply voltage can move between just over 3V and 5.25V.<\/p>\n\n\n\n

These power supplies provide the different voltages that the meter needs to operate.<\/p>\n\n\n\n

Firstly, we have a voltage booster, which is responsible for raising the voltage up to 5V and which is built with a DC-DC booster integrated circuit AP2005 of Chinese origin, and of which I have not been able to find datasheet in English.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

From what I've been able to discover, the AP2005 is an asynchronous PWM booster up to 3.5A at 1Mhz. It has a maximum efficiency of 92% and 100\u03bcA of current consumption at idle.<\/p>\n\n\n\n

The meter also has a 3.3 V AMS1117 integrated to supply this voltage, with up to 1A of current, to the parts of the meter that require it. This chip has a typical quiescent current consumption of 5mA, which is quite high for a device that can run on battery power.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

I leave you here the AMS1117 datasheet<\/a> in case you want to know more.<\/p>\n\n\n\n

Buzzer<\/h4>\n\n\n\n

The buzzer circuit is very simple. It has only a small, apparently passive, buzzer and a transistor to supply it with the current it needs.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Particle sensor<\/h4>\n\n\n\n

The airborne particulate sensor is a laser-type sensor and is almost identical to the model ZH03B <\/strong>of Winsen, although not exactly the same<\/strong>as we shall see below. It does not carry any kind of label or marking indicating its model.<\/p>\n\n\n\n

It is very likely to be an older, smaller or less accurate version of the ZH03B, although the differences will probably not be too great.<\/p>\n\n\n\n

In the following table you can see main characteristics of the ZH03B sensor<\/strong>:<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

As you can see the accuracy of their measurements is \u00b115 \u00b5g\/m3 when measuring between 0 and 100 \u00b5g\/m3 and \u00b115 \u00b5g\/m3 of the measurement when measuring between 101 and 1000 \u00b5g\/m3.<\/p>\n\n\n\n

Note also the MTTF (Mean Time Between Failure Time) of only 10000h<\/strong>. This means that the sensor will not last forever<\/strong>This is by no means the case (no sensor of this type does this and this is a common figure for such laser sensors).<\/p>\n\n\n\n

So that you don't have to do the maths, I'll tell you that 10000 hours are 416,667 days<\/strong>The average time between failures is just under one and a half years.<\/p>\n\n\n\n

Here is the ZH03B datasheet <\/a>in case you want to know more.<\/p>\n\n\n\n

Here you can see the ZH03B sensor on AliExpress<\/a> in case you want to see how much it costs in the official Winsen shop - surprisingly, it costs more than the meter!<\/p>\n\n\n\n

CO\u2082 sensor<\/h4>\n\n\n\n

The CO2 sensor in the meter has been a surprise, as I am used to many different sensors on the market.<\/p>\n\n\n\n

I'll start by saying that this is not a sensor made by Winsen, although it looks very similar (see the update below).<\/p>\n\n\n\n

Its physical layout, in terms of pins, distribution of the ventilation windows, etc., is the same as that of the Winsen MH-Z19 sensor (an older model that has been discontinued for some years).<\/p>\n\n\n\n

The biggest surprise is that this sensor has electronic components in the air on its printed circuit board (underneath the sensor) whereas all other Winsen sensors I know of have all the components inside (in this respect it resembles the sensors made by the Chinese manufacturer Cubic).<\/p>\n\n\n\n

Another difference is in its case. Its case is a shiny silver-coloured plastic while all the sensors I knew so far from Winsen were gold-coloured.<\/p>\n\n\n\n

As we will see below, the sensor's communication protocol does not resemble that of other Winsen sensors either.<\/p>\n\n\n\n

Update 06\/05\/2021:<\/strong><\/h5>\n\n\n\n

After further investigation, it appears that it is the QC103 sensor from the Chinese company Q&C Sensing Technology (Shenzhen Qincheng Sensing Technology Co., Ltd.). A little known sensor, until now.<\/p>\n\n\n\n

On paper its characteristics are indeed very similar to the Winsen MH-Z19B, although in practice it seems to be much less accurate in its measurements.<\/p>\n\n\n\n

A major limitation is that you do not have access to its full communications protocol, which means that you do not know for sure whether you have your self-calibration enabled or how to do an on-demand calibration.<\/p>\n\n\n\n

Here you can find the QC103 datasheet<\/a> (in Chinese, I have not found an English version) and here is the link to the website QC103 website<\/a> on the manufacturer's website (the website is no longer available, I have replaced it with a copy I found on Wayback Machine).<\/p>\n\n\n\n

In the datasheet you can see that there is a sensor configuration program called MK46XTestTool, although I have not been able to find it no matter how hard I have looked for it.<\/p>\n\n\n\n

Here are the most important technical specifications, which I have translated from Chinese:<\/p>\n\n\n\n

Technical parameters<\/strong><\/strong><\/p>\n\n\n\n

The measurement range<\/td>400~5000ppm Expandable 0-6000 ppm<\/td><\/tr>
accuracy<\/td>+\/-50ppm plus5%reading (1)(2).<\/td><\/tr>
Response time (t90)<\/td><120s<\/td><\/tr>
Warm-up time<\/td><8s (output value).<120s(accurate output).<\/td><\/tr>
Measurement cycle<\/td>4s<\/td><\/tr>
Temperature dependence<\/td>\u00b1 5 ppm\/C or 0.5% reading\/<\/td><\/tr>
Operating voltage<\/td>4.5~5.5V<\/td><\/tr>
Output signal<\/td>UART, PWM, I2C (customised).<\/td><\/tr>
Communication level<\/td>3.3V<\/td><\/tr>
Average current<\/td><30mA (5V)<\/td><\/tr>
Operating temperature<\/td>0 ~ 50 \u00b0C<\/td><\/tr>
Operating humidity<\/td>0 to 95%RH no condensation<\/td><\/tr>
Operating pressure<\/td>700~1100mbar<\/td><\/tr>
Store the temperature<\/td>-20.0 ~ 60.0 \u00b0C<\/td><\/tr>
Product size<\/td>33mm X 21mm X 11mm (without pins).<\/td><\/tr>
Life expectancy<\/td>10 years<\/td><\/tr>
Calibration cycle<\/td>No calibration required (turn on self-calibration in normal IAQ applications).<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

(1): Accuracy is measured at room temperature of 25degrees C and atmospheric pressure of 101.3kpa. To verify sensor uncertainty, add uncertainty (\u00b12%) of the standard gas used for calibration.<\/p>\n\n\n\n

(2): In normal indoor air quality applications, sensor accuracy is defined for more than 3 minutes after the auto-calibration function is turned on and running continuously for three weeks.<\/p>\n\n\n\n

(3): Auto-calibration is based on the atmospheric atmosphere CO2 concentration of 400ppm, as a reference point sensor automatically perform calibration algorithm, the default auto-calibration cycle is 24 hours, support custom calibration cycle.<\/p>\n\n\n\n

Temperature sensor<\/h4>\n\n\n\n

The temperature sensor is some kind of thermistor.<\/p>\n\n\n\n

A thermistor is a special type of resistor whose resistive value varies more strongly with temperature than that of a common resistor. Its operation is based on the change in resistivity of a semiconductor with temperature.<\/p>\n\n\n\n

It does not have any markings on it so I have not been able to find out what it is, and therefore its measuring range and accuracy.<\/p>\n\n\n\n

Humidity sensor<\/h4>\n\n\n\n

The relative humidity sensor looks like some kind of capacitive type sensor. <\/p>\n\n\n\n

Nor is there any reference to identify it, so we do not know its measurement range and precision.<\/p>\n\n\n\n

Processor<\/h4>\n\n\n\n

The microprocessor is a MS51FB9AE from the Asian manufacturer Nuvoton.<\/p>\n\n\n\n

This is a Chinese version of the 8051 microprocessor. A near-standard in industrial microprocessors and certainly a chip with plenty of power for this meter and great peripheral management.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

I leave you here the MS51FB9AE datasheet<\/a>.<\/p>\n\n\n\n

Display controller<\/h4>\n\n\n\n

The display controller chip looks like a TM1621 from the Chinese company Shenzhen Titan Micro Elec. As in other cases of components of Chinese origin I have not found datasheet in English, nor more information.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

If you dare with its datasheet in Chinese, here it is<\/a>.<\/p>\n\n\n\n

Battery <\/h4>\n\n\n\n

The battery is a Li-Ion (lithium-ion) type in 16850 format and is unmarked, although I have to say that it comes shrink-wrapped in an opaque blue plastic, which I have not removed, so you can't see the cell directly.<\/p>\n\n\n\n

I didn't think it was important to see the cell, so I didn't take the trouble to remove the shrink-wrap. I have tested the charge, and I have been able to verify that it charges approximately 1900mAh.<\/p>\n\n\n\n

Reverse engineering of protocols<\/h2>\n\n\n\n

Once we know the components of the meter, it is time to reverse-engineer the protocols that the meter's sensors use to communicate.<\/strong> to try to be able to understand them in order to be able to use them in other projects.<\/p>\n\n\n\n

Armed with a logic analyser<\/strong>which is an apparatus together with software specialised in the capture and analysis of communications<\/strong> between different elements, I set out to capture these communications and analyse them.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

CO\u2082 sensor protocol<\/h3>\n\n\n\n

Since the sensor is very similar in appearance to the Winsen MH-Z19, I carry out some checks on its pins, with the help of a multimeter and oscilloscope, and I check that its connections match (at least the power and communications connections, which are the ones I am interested in at the moment).<\/p>\n\n\n\n

I activate the capture on the logic analyser while I check the CO2 measurements on the screen and capture the data for 30 seconds.<\/p>\n\n\n\n

This is the result, enlarged to the area of interest:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

You can see on channel 0 the communication from the sensor to the microcontroller and on channel 1 the communication from the microcontroller to the sensor.<\/p>\n\n\n\n

As you can see, the controller sends a sequence to the sensor (channel 1) requesting the measurement and the sensor responds, 100ms later (channel 0), with a frame containing the measurement data.<\/p>\n\n\n\n

This is the query that the microcontroller launches the sensor:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Although it is always the same, it seems to be composed of a two-byte header (0x64 0x69), the data length (0x03) and a two-byte CRC (0x5E 0x4E).<\/p>\n\n\n\n

If we focus on the data received, we find the following:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

We can see a structure very similar to what would be produced in an MH-Z19 sensor and, making some assumptions, I can figure out the command that the microcontroller sends to the sensor to request a measurement and decipher the protocol in order to be able to extract such a measure<\/strong>. The first part is achieved!<\/strong><\/p>\n\n\n\n

I have circled in red the two bytes (0xA4 0x05) that correspond to the CO2 concentration. If we invert the two bytes and convert it to decimal 0x05A4 = 1444<\/strong>. Just what the DM306 shows us on the screen, we have it!<\/strong><\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

The protocol appears to be a modified Modbus, with a 28-byte frame split into: a 2-byte 0x64 0x69 header (always the same), two bytes with unknown content, two bytes containing the CO\u2082 measurement in hexadecimal in reverse order (most significant byte first), 6 bytes with unknown content and a two-byte checksum of type ModbusCRC16 <\/strong>which is used by the receiver to check if all the received data is correct (if the sum of the received data does not match, the whole frame is discarded).<\/p>\n\n\n\n

The particle sensor protocol<\/h3>\n\n\n\n

As I did in the previous case, I capture the data for 30 seconds with the help of the logic analyser and analyse the result, comparing it with the already known protocol of the ZH03B sensor.<\/p>\n\n\n\n

The result is encouraging.<\/p>\n\n\n\n

This is a longer frame than ZH03B but keeps the same bytes in the header. <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

After some simple calculations, comparing them with the measurements displayed on the screen, which I have taken the precaution of recording on video synchronously with the data capture, I decipher how the measurements are transmitted.<\/p>\n\n\n\n

The structure is very similar to that of the CO2 sensor, two start bytes, two bytes with the length of the data, then the sensor data, a few bytes at 0 and a checksum (a simple checksum from byte 1 to byte 30).<\/p>\n\n\n\n

I also note that the protocol is very similar, and has the same header and length, to that of the PMS1003, PMS5003 and PMS7003 sensors.<\/p>\n

<\/div>","protected":false},"excerpt":{"rendered":"

After doing the initial analysis, it was time to do what I really bought the DM306 for... tear it apart! Curiosity kills me, and I need to know what's inside and how it's made. In case you haven't read the previous article with the analysis (I recommend you do so) we talked about this meter: The ... Read more<\/a><\/p>","protected":false},"author":1,"featured_media":238397,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","_lmt_disableupdate":"no","_lmt_disable":"no","footnotes":""},"categories":[10],"tags":[],"class_list":["post-238392","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analisis"],"modified_by":"Mariete","uagb_featured_image_src":{"full":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306.png",1620,912,false],"thumbnail":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306-150x150.png",150,150,true],"medium":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306-300x169.png",300,169,true],"medium_large":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306-768x432.png",768,432,true],"large":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306-1024x576.png",1024,576,true],"1536x1536":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306-1536x865.png",1536,865,true],"2048x2048":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306.png",1620,912,false],"trp-custom-language-flag":["https:\/\/emariete.com\/wp-content\/uploads\/2021\/04\/Hacking-Medidor-CO\u2082-y-Particulas-DM306.png",18,10,false]},"uagb_author_info":{"display_name":"Mariete","author_link":"https:\/\/emariete.com\/en\/author\/admin_xlyz052h\/"},"uagb_comment_info":1,"uagb_excerpt":"Tras hacer el an\u00e1lisis inicial era el momento de hacer aquello para lo que realmente hab\u00eda comprado el DM306. \u00a1Destriparlo! La curiosidad me mata, y necesito saber qu\u00e9 tiene dentro y c\u00f3mo est\u00e1 hecho. Por si no has le\u00eddo el art\u00edculo anterior con el an\u00e1lisis (te recomiendo que lo hagas) hablamos de este medidor: El…","_links":{"self":[{"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/posts\/238392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/comments?post=238392"}],"version-history":[{"count":2,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/posts\/238392\/revisions"}],"predecessor-version":[{"id":241547,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/posts\/238392\/revisions\/241547"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/media\/238397"}],"wp:attachment":[{"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/media?parent=238392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/categories?post=238392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emariete.com\/en\/wp-json\/wp\/v2\/tags?post=238392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}