Friday, 10 March 2017

Detect CO with a MQ-7 sensor module

How to detect carbon monoxide with a MQ-7 sensor module

How gas sensors work

I found an excellent thesis paper on how Tin Dioxide (SnO2) gas sensors work here. It also goes into the details of it's temperature dependency. (See details further down)


Watch my video on the tests here.

The module from ICStation

You can get this module here. (Use code andyics for 15% off your order)
The intended mode of operation is to apply 5V to the module and either read analog values from AOUT or set the threshold of the comparator to the desired value and read from the DOUT pin if it has tripped.

The terminals

Comparator and trimmer

It seems to me that ICStation treats all MQ-series sensors the same way. But the MQ-7 is different from the rest. According to the data sheet, it gives the best results on the following cycle:

  • Pre-heat sensor for 48h 
  • Heat heater with 5V for 60 seconds
  • Heat at 1.4V for 90 seconds
  • Read the sensor near the end of the 90 seconds
On 5V alone, the module does "sortof" work.

You can see me breathing at the sensor

I am quite sure there is no siginificant quantity of CO in my breath. And I not a smoker. The sensor reacts to a wide range of gases, as well as moisture and ambient temperature,

Tricking the module into datasheet-like conditions

To build this, you need the following components:

The IRLZ34N is a very common N-Channel MosFET what already has a very low (0.046 Ohm) source-drain resistance with 5V at the gate. It can handle currents way beyond our reqirements for the flimsy heater on the module.
The heater can run on DC or AC, so PWM should be ok. I can then set the duty cycle of the PWM so that it is the equivalent of 1.4V. (See code below.)

The 10k resistor is optional

The setup with the "switching" mosfet.
Setup with Mosfet

The Arduino code

The code for the "proper" usage cycle:

 MQ-7 cheater  
 Uses PWM and an N-Channel MosFET to trick an ICSTATION MQ-7 CO detector  
 into measuring CO according to the datasheet of the manufaturer.  
 int sensorPin = A0;  // select the input pin for the CO sensor  
 int sensorValue = 0; // variable to store the value coming from the sensor  
 // Initial setup  
 void setup() {  
  // initialize digital pin LED_BUILTIN as an output  
  // initialize the serial port  
 // the loop function runs over and over again forever  
 void loop() {  
  analogWrite(LED_BUILTIN, 255);  // turn the heater fully on  
  delay(6000);            // heat for 60 second  
 // now reduce the heating power  
  analogWrite(LED_BUILTIN, 72);  // turn the heater to approx 1,4V  
  delay(9000);            // wait for 90 seconds  
 // we need to read the sensor at 5V, but must not let it heat up. So hurry!  
  digitalWrite(LED_BUILTIN, HIGH);  
  delay (50); //don't know how long to wait without heating up too much. Getting an analog read apparently takes 100uSec  
   // read the value from the sensor:  
  sensorValue = analogRead(sensorPin);  

Increased sensitivity

Under the same conditions (candle suffocated under jar), the FET-Pulsed version showed a significantly higher peak.
FET-Pulsed heater

Heater on 5v constantly
While the pulsed version of the detector has a slower detection rate (once every 2.5 minutes), the signal's signal-to-noise ratio is signigicantly better (400:14 vs 220:28), resulting in better sensitivity.

Other options:

Cut the traces on the PCB and rewire, so the heater and the sensor don't run from the same power source. (I.e. run cycle the heating element at 5/1.4, while keeping constant 5V on the sensing element's voltage divider)

Friday, 24 February 2017

Hacking the BSIDE ADM20 Multimeter - Software

BSIDE ADM20 hack 1: Software

How I got into this

When I worked on a review of a battery charger, I came accross some potential issues that I had to investigate things more thoroughly. I needed a multimeter to record the charge curves.
So my contact at Gearbest sent me this BSide ADM20 Multimeter. This has a built-in USB interface to display and record mesaurements on the PC.
Values imported into LibreOffice Calc
It turned out I quite like the meter. See my review video here. (Hardware-hack will follow) The software however was rather basic and wouldn't allow to set a sample rate or measurement duration.

The meter is available under several names:

I already had a look inside the meter and see pretty cool options to turn this into an IoT device. But let's not jump to conclusions. Some more work needs to go into that and I have only focussed on the software side here.


Fortunately it is pretty obvious how the meter communicates with (or rather "to") the PC:
A new COM port appears, presented through the well known CH340 USB-to-SERIAL bridge driver.
And you thought COM-Ports were a thing of the past
If you then fire up the software (DMM Data logger) that came with the meter, you're good to go.

Original Software

Nooo! Boooooooring!!!!

A look at the protocol

Pretty obvious that I should see something when I start a a terminal program like TeraTerm od Putty.
In part 2 of this post, you'll see that this is strictly a one-way communication. So we can't talk back to the meter.

  • The port speed is 2400 baud.
  • There is no CR or LF at the end of each data set (see below)
  • The usual 8n1 seems to apply
  • Continuous stream of data: no xon/xoff
  • No return channel

With the width set properly, TeraTerm's hex mode shows a pattern:
The 5Fs are the Zeroes, the DF has the decimal point

Whatever I do, the transmission always starts with a series of HEX values: AA5552240110
followed by four bytes that change when stuff moves on the display. I could map the values to the following displayed digits: (excerpt from my visual basic prog)

        If SerVal = 95 Then measured = 0
        If SerVal = 6 Then measured = 1
        If SerVal = 107 Then measured = 2
        If SerVal = 47 Then measured = 3
        If SerVal = 54 Then measured = 4
        If SerVal = 61 Then measured = 5
        If SerVal = 125 Then measured = 6
        If SerVal = 7 Then measured = 7
        If SerVal = 127 Then measured = 8
        If SerVal = 63 Then measured = 9

It turns out that the most significant bit is the decimal point, the other bits map to the seven segments. It also sends the measured unit and the polarity further back in the data stream. Up to now I choose to ignore all of that.

The four bytes with the four digits are in reverse order, of course, for more programming fun.

So my VisualBasic program listens for the "AA555224110" sequence and then decodes the four following bytes.

I suspect that the data stream is derived from the communication with the display driver, as many bits in the data stream can directly be mapped to segments on the display.

More on those details in the second part where I will look at the hardware of both the meter and it's communication.

First try in VisualBasic

No decimal point yet.
That was once a 9v battery

If you want to have a go at the experimental code, here is where I left off for the moment:

 Imports System.Threading.Tasks  
 Imports System.Timers  
 Imports System.IO  
 Imports System.IO.Ports  
 Imports System.Threading  
 Public Class Form1  
   Dim datensatz As String  
   Dim rohwert As Integer  
   Dim werte(22) As Integer  
   Dim decodewerte(4) As Integer  
   Dim recorddata As Boolean = False  
   Dim i As Integer = 0  
   Delegate Sub DataDelegate(ByVal sdata As Integer)  
   REM Define the method (Function) that will be called by the Invoke method   
   Private Sub PrintData(ByVal sdata As Integer)  
     Dim startsequence As String = "AA555224110"  
     Dim tmpchar As String  
     Dim str As Integer  
     Dim measured As Integer  
     Dim x As Integer  
     If recorddata Then  
       werte(i) = sdata  
       Console.Write("I= ")  
       If i = 4 Then  
         recorddata = False  
         i = 0  
         tmpchar = Hex(werte(1))  
         REM Console.WriteLine(werte(1))  
         x = DecodeValue(werte(1))  
         decodewerte(1) = x  
         Label2.Text = x  
         tmpchar = Hex(werte(2))  
         REM Console.WriteLine(werte(2))  
         x = DecodeValue(werte(2))  
         decodewerte(2) = x  
         Label3.Text = x  
         tmpchar = Hex(werte(3))  
         REM Console.WriteLine(werte(3))  
         x = DecodeValue(werte(3))  
         decodewerte(3) = x  
         Label4.Text = x  
         tmpchar = Hex(werte(4))  
         REM Console.WriteLine(werte(4))  
         x = DecodeValue(werte(4))  
         decodewerte(4) = x  
         Label5.Text = x  
         TextBox1.Text = CStr(decodewerte(4)) & CStr(decodewerte(3)) & CStr(decodewerte(2)) & CStr(decodewerte(1))  
       End If  
       i = i + 1  
     End If  
     tmpchar = Hex(sdata)  
     Label1.Text = tmpchar  
     datensatz = datensatz + tmpchar  
     If (datensatz.Contains(startsequence)) Then  
       REM Console.WriteLine("Got Header")  
       datensatz = ""  
       recorddata = True  
     End If  
   End Sub  
   Public Sub New()  
     ' This call is required by the designer.  
     ' Add any initialization after the InitializeComponent() call.  
   End Sub  
   Dim WithEvents sp As New SerialPort  
   Private Sub GetSerialPortNames()  
     sp.BaudRate = 2400  
     sp.PortName = "COM3"  
     sp.DataBits = 8  
     sp.Parity = Parity.None  
     sp.StopBits = StopBits.One  
     sp.Handshake = Handshake.None  
     REM sp.Encoding = System.Text.Encoding.Default  
     sp.Encoding = System.Text.Encoding.Default  
   End Sub  
   Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load  
   End Sub  
   Private Sub SerialPort_DataReceived(ByVal sender As Object, ByVal e As System.IO.Ports.SerialDataReceivedEventArgs) Handles sp.DataReceived  
     Dim str As Integer  
     REM Dim str2 As Char  
     str = sp.ReadChar()  
     REM Console.WriteLine(str)  
     REM str2 = Convert.ToChar(str)  
     Dim adre As New DataDelegate(AddressOf PrintData)  
     Me.Invoke(adre, str)  
   End Sub  
   Function DecodeValue(ByVal SerVal As Integer)  
     Dim decimalpoint As Boolean = 0  
     Dim measured As Integer  
     If SerVal > 128 Then  
       SerVal = SerVal - 128  
       decimalpoint = True  
     End If  
     measured = 99  
     If SerVal = 95 Then measured = 0  
     If SerVal = 6 Then measured = 1  
     If SerVal = 107 Then measured = 2  
     If SerVal = 47 Then measured = 3  
     If SerVal = 54 Then measured = 4  
     If SerVal = 61 Then measured = 5  
     If SerVal = 125 Then measured = 6  
     If SerVal = 7 Then measured = 7  
     If SerVal = 127 Then measured = 8  
     If SerVal = 63 Then measured = 9  
     If SerVal = 8097 Then measured = 7  
     If SerVal = 8096 Then measured = 1  
     If SerVal = 0 Then measured = 0  
     Console.Write("Decoder got a: ")  
     Console.Write(" decoded as: ")  
     Return measured  
   End Function  
 End Class  

If you have done work on hard- or software-hacking those meters please let me know.

Saturday, 18 February 2017

Can't make voice call with Siri - Solution

Since the upgrade to iOS 10, I could not get Siri to dial any numbers from my address book.
I changed quite a few of Siri's settings back and forth, but was unable to fix the problem. Resets and restarts would not help either.

What finally helped was a rather unexpected:

  • I switched off the "Dial Assist" function in the "Phone" settings and Siri was able to make calls again.
  • I then switched "Dial assist" back on and Siri could still dial without any issues.

Problem solved.
I can just assume, that some not otherwise accessible parmeter has been set to a valid value when switching Dial Assist off and on.

Sprachwahl mit Siri funktioniert nicht: Lösung

Siri hat ein Problem:

Seit dem Update auf iOS 10 konnte ich per Siri - Sprachwahl nicht mehr wählen. Neustart oder die Änderung von Siri - Einstellungen blieben wirkungslos.

Keine Sache der Einstellung

Die Lösung für dieses Problem liegt nicht in den Siri-Einstellungen, sondern ist unter "Telefon" zu finden:

  • Nachdem ich die Funktion "Wählhilfe" abeschaltet hatte, ging die Sprachwahl.
  • Wählhilfe wie der aktiviert: Siri kann noch wählen.

Ich kann nur spekulieren, daß ein nicht anderweitig zugänglicher Parameter durch das Aus- und einschalten der Wählhilfe korrekt gesetzt wurde.

Friday, 3 February 2017

Using the Nitecore SC2 superb charger

Superb charger

on Nitecore's web pages for the "SC2 superb charger", there is no shortage of superlatives. Charging with "Infinite Intelligence" certainly is the boldest claim.

See for yourself >>> HERE <<< in my review video on YouTube.

Infinite intelligence

So I tried to find out more about the limits of this "active charging with infinite intelligence" thing. Gearbest sent me a unit for review and I put it through a few tests to see how it performs.

First impression

The charger feels quite tough & beefy to the to touch. The kind of plastic that doesn't feel plasticy, but rather reminds of high quality power tools. A good start.

Second impression

But why-oh-why are the settings for the current and max. charge voltage printed on what looks like a sheet of protective film that easily comes off the display.
I'm sure if I don't constantly use that charger, I'll have forgotten what which LED means what after a few days. Nitecore has to do something about that in the next iteration of the SC2.

Automatic battery capacity detection

Now this should be what is at the heart of this ominous infinite intelligence. The traditional way to determine the battery's capacity is to discharge them and measure the capacity that they charge to, possibly adding another discharge/charge cycle. Nitecore's web pages claim that it automatically detects the battery's capacity and sets the charge current accordingly.
So come on SC2, impress me!

Test setup

First, I have to know about my cell's actual capacity. To find that out, I use an improved version of my previously published Arduino battery tester.

Makeshift battery tester

I use four cells for testing:
  1. AWT 18650 35A 3000 mAh IMR cell 
  2. Ultrafire 18650 3000mAh (Really is only 300mAh)
  3. KeepPower 14500 800mAh 
  4. Ultrafire 14500 1200mAh (Really a little over 200 mAh)
With automatic battery capacity detection, The good quality cells AWT and KeepPower cells should charge at a higher rate than the Ultrafires (who in all tests had only a fraction of their nominal capacity, regardless of the charger.)

Size matters

As cells with the same size charge at the same current, I wondered what happened if I make the 14500 appear bigger. So I inserted a spacer with the 14500 cell.
14500 to 18650 converter :-)

Nut&bolt spacer inserted
It charged at 2A. Way above the recommended 0,4-0,8A (Unconfirmed, from reseller pages)

The assumption that bigger cells hold more capacity might on the whole be correct. But we all know that there are good and bad cells and that makes way more of a difference than the size.

The limits of infinite intelligence

There is more that will confuse the charger:
  1. LiFePO4 cells: The charger can't distinguish LiFePO4 cells from Li-Ion cells and would overcharge them. So the maximum charge voltage has to be set manually
  2. 3,8V Li-Ion cells. I've never had or seen any of these, But as they are indistinguishable from a 3.7V cell, The charge voltage needs to be set manually.

Example Charge

While I had initially observed some brief overvoltage conditions, All the voltage (and charge curves I took) did not exhibit that phenomenon.
0,5A charge curve
I did many of the long-term measurements with PC on the USB-Port of the bside ADM20 Multimeter that I quite like. I also got from Gearbest to get a better grip on some problems I suspected with the SC2 charger.
bside ADM20 at work with a current shunt resistor
The multimeter turned out to be quite hackable. But that will be a whole new blog entry & video.

Final word

  • Great charger if you're in a hurry. Very fast and reasonably safe.
  • Supports all currently available battery chemistry types.
  • Sometimes has trouble disabling the protection circuit in KeepPower batteries.
  • Needs help choosing the right battery chemistry.

Thursday, 26 January 2017

High CPU usage on Surface Pro3 running Windows 10

System interrupt uses one CPU core

Windows 8.1

I already had this issue running Windows 8.1 and could work around it, simply disabling the realtek high definition audio driver, that seems to be the docking station's audio system.

Windows 10

The problem came back with Windows 10. But this time disabling drivers did not help.
That should be an "idle" system

What brought the fan to a standstill, however was:
Restarting the Surface Pro 3 while in the docking station.
I don't mean powering it down and switch it back on again. That doesn't do any good. It is the restart that does the trick for me.
A very relaxed CPU
This, of course, is only a very temporary solution. So whenever the fan (which rarely ever stops completely) gets on my nerves, I reboot and things are better for the rest of the day.

Docking station drivers?

I suppose that a driver for the docking station's peripherals causes the problems. But disabling any of them did not cure the problem, so I might be wrong. Can anyone shed more light on that issue?


Edit 2017-03-08: The current driver package SurfacePro3_Win10_1700802_1.msi did not help either.

Monday, 23 January 2017

More work on the TOP-308 IP Camera

Great news on the TOP-308 IP camera

Root access to the camera

Last year I got this Top-308 IP camera and got a little stuck as I couldn't get full access.
Now user Choziro over on the IPCamTalk-Forum has found a great way to get full root access to the Linux OS of the camera.

This is how it is done:

  • Telnet to port 9527 of your camera. (Most likely 9527)
  • log on as "admin" with an empty password
  • type "shell"
  • type "telnetd -f"

The session is more or less stuck at that point, but that does not matter.

  • Now telnet to your camera ( at the default telnet port 23
  • User name is "root"
  • Password is "xmhdipc"
  • You now have a nice busybox shell that behaves much better than on port 9527
Rootshell !

No still images from the camera

Nosing around in the file system showed that there was no obvious way to get a single image from the camera. But that is what I need. So I resorted to letting my Raspberry Pi do that job:

This works both with avidemux and ffmpeg:

avconv -i "rtsp://" -vframes 1 "image.png"

That will capture a single frame from the camera and write it to a file "image.png".
Putting that into the RasPi's crontab could copy an image to a web site.