loading

Cen-Tech Thermometer to PC Hacking

I just got my new $30 Cen-Tech thermometer from Harbor Freight and it's begging to be hacked. I would love to be able to use this thermometer as part of a closed loop system to control a hot plate for soldering purposes. Just inside the battery compartment is a header with four pins. They nicely labeled the pins on the silk screen. I'm probing on "Gnd" and "Tx" pins. I used a MAX232 level shifter to convert the TTL output to RS232 so I could connect to my PC. I then ran the attached simply Python app that dumps the data packets to the console. Each packet has 25 characters and repeats at about 3Hz. My question is, how would one go about decoding the data packets? Some numbers seem constant while other move. I'm hoping the data format is obvious to someone. Note, the reading on the display was around 68.8 degrees F when this data was collected. The readings did jump plus/minus a few tenths while collecting. Any ideas? Thanks, Jim Console Output: 33 15 11 00 3A 07 9B 14 1B 1E 82 FF 15 07 A9 12 F7 01 CA 0B 97 0C 00 00 4A 33 15 11 00 3A 07 9B 14 1B 1E 82 FF 15 07 A9 12 F7 01 CA 0B 97 0C 00 00 4A 33 15 11 00 3A 07 9B 14 1B 1E 82 FF 15 07 A9 12 F7 01 CA 0B 97 0C 00 00 4A 33 15 10 00 3A 07 9B 14 1B 1E 81 FF 15 07 A9 12 F6 01 CA 0B 97 0C 00 00 47 33 15 10 00 3A 07 9B 14 1B 1E 81 FF 15 07 A9 12 F6 01 CA 0B 97 0C 00 00 47 33 15 11 00 3A 07 9B 14 1B 1E 82 FF 15 07 A9 12 F7 01 CA 0B 97 0C 00 00 4A 33 15 11 00 3A 07 9B 14 1B 1E 82 FF 15 07 A9 12 F7 01 CA 0B 97 0C 00 00 4A 33 15 12 00 3A 07 9B 14 1B 1E 84 FF 15 07 A9 12 F8 01 CA 0B 97 0C 00 00 4E 33 15 13 00 3A 07 9B 14 1B 1E 85 FF 15 07 A9 12 F9 01 CA 0B 97 0C 00 00 51 33 15 11 00 3A 07 8F 14 1B 1E 82 FF 15 07 9E 12 F7 01 CA 0B 9C 0C 00 00 38 33 15 11 00 3A 07 8F 14 1B 1E 82 FF 15 07 9E 12 F7 01 CA 0B 9C 0C 00 00 38 33 15 11 00 3A 07 8F 14 1B 1E 82 FF 15 07 9E 12 F7 01 CA 0B 9C 0C 00 00 38 33 15 09 00 51 07 63 17 65 1D 81 FF 2C 07 2D 15 F1 01 00 0C 92 0B 00 00 35 33 15 0B 00 51 07 63 17 65 1D 84 FF 2C 07 2D 15 F3 01 00 0C 92 0B 00 00 3C 33 15 0A 00 51 07 63 17 65 1D 82 FF 2C 07 2D 15 F2 01 00 0C 92 0B 00 00 38 33 15 0A 00 51 07 63 17 65 1D 82 FF 2C 07 2D 15 F2 01 00 0C 92 0B 00 00 38 33 15 0A 00 51 07 63 17 65 1D 82 FF 2C 07 2D 15 F2 01 00 0C 92 0B 00 00 38 33 15 0A 00 51 07 63 17 65 1D 82 FF 2C 07 2D 15 F2 01 00 0C 92 0B 00 00 38 33 15 0A 00 51 07 63 17 65 1D 82 FF 2C 07 2D 15 F2 01 00 0C 92 0B 00 00 38 33 15 0A 00 51 07 63 17 65 1D 82 FF 2C 07 2D 15 F2 01 00 0C 92 0B 00 00 38 33 15 0B 00 51 07 63 17 65 1D 84 FF 2C 07 2D 15 F3 01 00 0C 92 0B 00 00 3C

Picture of Cen-Tech Thermometer to PC Hacking
Image1.jpg
DSCN3541.JPG
DSCN3540.JPG
DSCN3528.JPG
serial.py464 bytes
sort by: active | newest | oldest
DogP7 years ago
Hey,

I picked one of these up the other day and noticed the same RS232 as you, so I hooked it up and saw a similar data stream.  Looking for more info on it, I did a search, but this is the only useful link I've found.

So, anyway, though it seems you've moved on with a different method, I figured I'd post here in case anyone else searches for info on this, or you think up a different use for yours.  I haven't completely reverse engineered the message, but the important one is the object temperature.  That is bytes 16 and 17 (0-indexed), in little endian.  So in your first message, it's F7 01, or 01F7 hex, which is 503 dec.  Then you divide by 10 to get 50.3 (0.1 deg C resolution), then subtract 30, and you get 20.3, which is the temperature in degrees C.  I assume they subtract 30, so a 0 value is under-range (though they advertise min temp as -20C).  You can check that by converting to F, which is ~68.5 F (you said it was around 68.8).

Other than that, it seems 3315 is always the start of the message (I've never seen it change, and it's the same on yours).  The last byte is a checksum... which is just the sum of the entire message +4 (why +4, I dunno, but I assume they added something so a string of all 0s wasn't considered valid).  I assume one of the fields is the ambient temperature, then maybe some status messages, like battery life or something.

FYI, here's a typical message from my unit.
33 15 C5 01 1B 08 5B 0F 62 16 A0 02 11 08 40 0F 59 03 14 0E 2B 0E FF A1 74

Also, I did a little bit of searching, and it seems the actual model is EM520B from all-sun (though that doesn't seem to bring up any more info).  It may be possible to find more info by contacting the mfgr, though I wouldn't count on it.  Of course that may also be rebranded, but they seem like a mfgr, not a reseller.

Though I haven't hooked them up yet, the other IR thermometers from Harbor Freight seem slightly more hacker friendly... they are rebranded ZyTemp TN105i2 and TN203 thermometers.  If you look on their site, they have documentation for interfacing/communicating to their embedded modules (over SPI), which these modules also have on a connector exposed by opening the case.  The 105 has a wide FOV, while the 203 has a narrower FOV, with laser.

Anyway, enough rambling... and I'll post again if I get around to decoding any more of the message.

DogP
DogP DogP7 years ago
Oops... just wanted to correct one minor thing.  On computing the checksum, I said to add 4... that's not correct.  When I was playing with it before, I accidentally replaced 3315 with 3311, so my computations were off by 4.  I looked at it again, and caught that mistake... it's just a plain checksum.

DogP
jimk3038 (author)  DogP7 years ago
 Awesome work. Thanks for sorting this out. 

Your right, I just didn't want to take the time to reverse engineer the protocol. Plus, since I needed a relay output anyway, I just designed a little Pic board that measured the temperature using something else. 

However, I still use my Cen-Tech way more. 

Thanks again,
Jim
Might be same as SPC digital caliper data format.

Look at this site: http://www.compendiumarcana.com/caliper/

Also look at www.thermo.com

http://www.thermo.com/com/cda/resources/resources_detail/1,2166,112406,00.html

Dig a little; Thermo has a free SPC reader application you can download. I just downloaded it but can't find the link already. I don't know what I will do with it, and now I forget why I came down in the basement ???

Good luck.
jimk3038 (author)  murrayatuptown7 years ago
Hey,

Have a look at this instructable I wrote:
https://www.instructables.com/id/IR-Temperature-Controller-for-SMD-Skillet-Reflow/

I gave up on hacking the Cen-Tech and went with an IR sensor from Melexis. I built my own interface board using just a simple Pic micro. Seems to work OK.

The Cen-Tech has a very small spot size. The Melexis takes an average over a larger area.

Thanks for the comments,
Jim
NachoMahma8 years ago
. First thing I would do is search the 'Net for a manual that might explain the data format. . If you can't find a manual, vary the temp that the probe sees and watch for the data to change. . There will be several pieces of data in there: unit ID (shouldn't change, so 33 15 is a good candidate), a timestamp of some sort, your data, and probably a few other items.