search

cpetrich / counterfeit_DS18B20

How to tell original from fake DS18B20 temperature sensors.
Apache License 2.0
595 stars 50 forks source link
authenticity counterfeit ds18b20 fake integrated-circuits onewire-slaves reverse-engineering

readme

Your DS18B20 temperature sensor is likely a fake, counterfeit, clone...

...unless you bought the chips directly from Maxim Integrated (or Dallas Semiconductor in the old days), an authorized distributor (DigiKey, RS, Farnell, Mouser, etc.), or a big retailer, or you took exceptionally good care purchasing waterproofed DS18B20 probes. We bought over 1000 "waterproof" probes or bare chips from more than 70 different vendors on ebay, AliExpress, and online stores -big and small- in 2019. All of the probes bought on ebay and AliExpress contained counterfeit DS18B20 sensors, and almost all sensors bought on those two sites were counterfeit.

Author: Chris Petrich, 8 May 2022. License: CC BY. Source: https://github.com/cpetrich/counterfeit_DS18B20/

(Sensor information based on sensors or probes ordered well into 2020 rather than in or around 2019 are marked "(2020)".)

TLDR; How do I know?

If the ROM does not follow the pattern 28-xx-xx-xx-xx-00-00-xx then the DS18B20 sensor is a clone [5].

Also, there are two Arduino sketches provided to test DS18B20 sensors:

Why should I care?

Besides ethical concerns, some of the counterfeit sensors actually do not work in parasitic power mode, have a high noise level, temperature offset outside the advertised ±0.5 °C band, do not contain an EEPROM, have bugs and unspecified failure rates, or differ in another unknown manner from the specifications in the Maxim datasheet. Clearly, the problems are not big enough to discourage people from buying probes on ebay, but it may be good to know the actual specs when the data are important or measurement conditions are difficult.

What are we dealing with?

Definitions differ, but following AIR6273, a counterfeit is an unauthorized copy, imitation, substitute, or modification misrepresented as a specific genuine item from an authorized manufacturer [13]. As of 2019, the main problem is imitations (clones) that are labeled to mislead the unsuspecting buyer. Fortunately, DS18B20 clones are nearly trivially easy to identify: Marking on the chip printed rather than lasered? No mark in the rear indent? Probably a conterfeit. Content of the "scratchpad register" doesn't comply with the datasheet? Probably a counterfeit. Behaves systematically different from known authentic chips? Probably a counterfeit.

What do they look like?

Authentic Maxim DS18B20 with topmark DALLAS DS18B20 1932C4 +786AB and indent marked "P"

Above is an example of an authentic, Maxim-produced DS18B20 sensor in TO-92 case.

To avoid confusion: the relevant Maxim part number of the chips investigated here is DS18B20+, i.e. TO-92 package and RoHS compliant. Not everything said on this page may apply to the DS18B20+PAR parasitic power-only variant (I cannot tell since I have only looked at a handfull of those). For the sake of brevity, the chips are referred to as DS18B20 as written in the datasheet [1].

How do I know if I am affected?

If the DS18B20 have been bought from authorized dealers though a controlled supply chain then the chips are legit.

Otherwise, (I) one can test for compliance with the datasheet. (One should actually, as even authentic parts may have been mishandled along an unauthorized distribution chain. But that's yet another issue.) If a sensor fails any of those tests, it is a fake (unless Maxim's implementation is buggy [4]). (II) one can compare sensor behavior with the behavior of Maxim-produced DS18B20. Those tests are based on the conjecture that all Maxim-produced DS18B20 behave alike. This should be the case at least for sensors that share a die code (which has been C4 since at least 2009 [5]) [5].

Regarding (I), discrepancy between what the current datasheet says should happen and what the sensors do include [1,5]

Hence, as of writing (2019), every fake sensor available does not comply with the datasheet in at least one way.

Regarding (II), there is one pathetically simple test for differences with Maxim-produced DS18B20 sensors that apparently all counterfeit sensors fail [5]:

In addition to obvious implementation differences such as those listed above under (I) and (II), there are also side-channel data that can be used to separate implementations. For example, the time reported for a 12 bit-temperature conversion (as determined by polling for completion after function code 0x44 at room temperature) is characteristic for individual chips (reproducible to much better than 1% at constant temperature) and falls within distinct ranges determined by the circuit's internals [5]:

Hence, there will be some edge cases between Families A and B, but simply measuring the time used for temperature conversion will often be sufficient to determine if a sensor is counterfeit.

An important aspect for operation is a sensor's ability to pull the data line low against the fixed pull-up resistor. Turns out this abilitly differs between families. The datasheet guarantees that a sensor is able to sink at least 4 mA at 0.4 V at any temperature up to 125 °C [1]. Providing a current of 4 mA (1.2 kOhm pull-up resistor against 5 V), the following low voltages were achieved by the sensors at room temperature (note that only 5 to 10 sensors were measured per Family):

All sensors are well within specs at room temperature but clustering of data by Family is apparent, indicating that the hardware was designed independently. It could be interesting to repeat these measurements above 100 °C.

Alternatively,

Note that none of the points above give certainty that a particular DS18B20 is an authentic Maxim product, but if any of the tests above indicate "fake" then it is most defintely counterfeit [5].

What families of DS18B20-like chips can I expect to encounter?

In addition to DS18B20 originally produced by Dallas Semiconductor and continued by Maxim Integrated after they purchased Dallas (Family A1, below), there are TO-92 clones produced independently by at least 5 other companies as of 2019 (Families B1, B2, C, D, E) [5]. The separation into families is based on patterns in undocumented function codes that the chips respond to as similarities at that level are unlikely to be coincidental [5]. Chips of Family B1 seem to be produced by GXCAS and calibrated and sold independently by GXCAS and UMW. Chips of Family B2 are produced by Beijing 7Q Technology (7Q-Tek). Both UMW and 7Q-Tek have corresponding datasheets on their respective web pages. Family D1 seems to be fading from sight, having been replaced by Family D2. Chips of Family A2 were a rare find, behave surprisingly similar to authentic chips but have poor temperature accuracy. Chips of Family E are a new addition to this page as of 2022.

In our ebay purchases in 2018/19 of waterproof DS18B20 probes from China, Germany, and the UK, most lots had sensors of Family B1, while one in three purchases had sensors of Family D. None had sensors of Family A1 or C. Neither origin nor price were indicators of sensor Family. When purchasing DS18B20 chips in TO-92 package, Family D2 was clearly dominant with Family B2 coming in second, and a small likelihood of obtaining chips of Families A1 or C.

In the ROM patterns below, tt and ss stand for fast-changing and slow-changing values within a production run [5], and crc is the CRC8 checksum defined in the datasheet [1].

Decapping DS18B20

Dies after decapping of authentic Maxim DS18B20 and clones

This collage shows photos of the dies of all DS18B20 Families we encountered in 2019. All photos are at the same scale, approx. 1.4 mm in width. We broke the TO-92 case open with pliers, detached the die from the plastic case by boiling in colophony, and removed the colophony with acetone in an ultrasonic bath. Photos were taken with a rather ancient USB camera.

Family A1 is the authentic Maxim-produced DS18B20 (C4 die). All other families are clones. Note the similarities between the dies of Families D1 and D2 (consistent with their similarity in software) and the signifcant differences between Families B1 and B2 (as opposed to their similarity in software).

Family A1: Authentic Maxim DS18B20

Obtained no probes containing these chips on ebay or AliExpress in 2019, but obtained chips from a few vendors in 2019

Family A1-Fishy: Authentic but Stolen?

Obtained no probes containing these chips on ebay or AliExpress in 2019, but obtained chips from one vendor in 2019

If I were to make a wild guess I would say these chips were diverted somewhere toward the end of the Maxim production pipeline (stolen?) [5]. Fun fact: the vendor advertised these chips as QT18B20, so as sold these were actually counterfeits of DS18B20 clones. These chips are marked as produced in Thailand rather than Philippines.

The chips follow the description of Family A1 above with the following exceptions [5]:

Family A2: Good Clone with Poor Temperature Performance

Obtained no probes containing these chips on ebay or AliExpress in 2019, but obtained chips from one vendor in 2019

These chips are not Maxim-produced.

The chips follow the description of Family A1 above with the following exceptions [5]:

Family B1: GXCAS 18B20, Matching Datasheet Temperature Offset Curve

Obtained probes from a number of vendors in 2019, obtained chips from two vendors in 2019. One vendor sent chips marked UMW rather than DALLAS

Family B2: 7Q-Tek QT18B20 with -0.5 °C Temperature Offset at 0 °C

Obtained both probes and chips of this series from a number of vendors in 2019. Three vendors sent chips marked 7Q-Tek rather than DALLAS

Family C: Small Offset at 0 °C

Obtained no probes but obtained chips from a few vendors in 2019

Family D1: Noisy Rubbish with Supercap

Obatined probes from two vendors in early 2019, obtained chips from one vendor in 2019

Family D2: XSEC SE18B20, Noisy

Obtained both probes and chips from a large number of vendors in 2019

Family E: NOVOSENSE NS18B20

Obtained neither chips nor probes in 2019. Bought chips clearly marked NS18B20 in 2022

This family has been added to the list as of 2022 and the characterization below is preliminary. The datasheet seems to suggest that the chips started production in 2019.

Obsolete as of 2019

Obtained neither probes nor chips in 2019

Solution to the 85 °C-Problem

There is a simple, undocumented, way to discriminate between the power-up 85 °C-reading and a genuine temperature reading of 85 °C in DS18B20 of Family A [5]: <byte 6> of the scratchpad register. If it is 0x0c, then the 85 °C-reading is a power-up reading, otherwise it is a true temperature measurement.

GXCAS 18B20

The DS18B20 clone of Beijing Zhongke Galaxy Core Technology Co., Ltd., trading as GXCAS, seems to be distributed independently by GXCAS and UMW (Family B1). According to their web page, GXCAS has only been around since January 2018. While GXCAS does not have a datasheet online, the datasheet on the UMW web page emphasizes the addition of two user-defined bytes in the scratchpad register, and the possibility of changing the ROM address [14]. A number of these chips bear fake DS18B20 topmarks. GXCAS is clearly proud of their product as they write their company name prominently onto the die.

7Q-Tek QT18B20

The QT18B20 is a DS18B20 clone developed and sold by Beijing 7Q Technology Inc, trading as 7Q-Tek (Family B2). The datasheet of the QT18B20 emphasizes the addition of two user-defined bytes in the scratchpad register [12]. Unlike the data sheet of the DS18B20, it does not state that the ROM code is lasered. A large number of these chips bear fake DS18B20 topmarks. 7Q-Tek is clearly proud of their product as they write their company name prominently onto the die.

While it is unclear who designed or produced chips of Family A2, Family A2 appears to have been an inspiration for the Family B2 7Q-Tek QT18B20, based on the following observations:

XSEC SE18B20

The SE18B20 is a DS18B20 clone of Xi'an Supermicro Electronics Co., Ltd., trading as XSEC (Family D2, and most likely also D1). (2022)

NOVOSENSE NS18B20

The NS18B20 is a DS18B20 clone of Suzhou Novosense Microelectronics Co., Ltd. (Family E). (2022)

MAX31820

Maxim Integrated also produce the MAX31820 temperature sensor. The MAX31820 is a DS18B20 with limited supply voltage range (i.e. up to 3.7 V) and smaller temperature range of high accuracy [1,8]. Like the DS18B20, it uses one-wire family code 0x28 [1,8]. Preliminary investigations have not (yet) revealed a test to distinguish between DS18B20 of Family A1 and Maxim-produced MAX31820 in software [5].

Methods

By popular request (Issue 11), this section is supposed to give background to (some of) the results and conclusions above. I'll add to it very slowly as time permits.

Investigations were on DS18B20 rather than the DS18B20-PAR variant or the DS18S20. We have only a hand full of DS18B20-PAR and DS18S20 sensors while we have hundreds of DS18B20. Also, all sensors were in the TO-92 case.

Sample basis for analysis of Family A1

Authentic Maxim DS18B20 serial number vs date code

Above figure shows the range of production dates and ROM codes (serial numbers) of the Family A1 sensors investigated that were bought as chips. Also included is a single-digit number of chips contained in probes that we opened to read off the topmark. The production date according to the date code is on the x-axis, the serial number according to the ROM is on the y-axis, the dots are the individual chips (N>200 but individual batches appear as smeared-out blobs), the gray area highlights 2019. We have chips produced from 2009 through 2020 and all chips have a C4 die, no chips have date codes of 2010, 2014, or 2015. (The serial number of a chip with ROM 28-13-9B-BB- 0B -00-00-1F is 0x0BBB9B13 and would thus fall between 0x0B and 0x0C on the y-axis.) We see that there is a long term relationship between serial number and date code (dashed line): the serial number increases by approximately 16,500,000 (i.e., approx. 2^24) per year. However, this relationship is only a general guide as can be seen by the degree of scatter around the line and in the enlargement in the inset: of the sensors produced in 2019 that we purchased there were three instances where sensors with a later date code contained an earlier serial number.

We seem to have purchased one of the last batches produced in 2016 with Trim2 calibration constants 0xDB or 0xDC, and one of the first batches with Trim2 calibration constants 0x73 or 0x74. Hence, the change probably took place between weeks 32 and 47 of 2016. (This is a statement about the DS18B20 rather than the DS18B20-PAR.)

Temperature data

Temperature data of DS18B20 sensors

Above figure shows (a) the temperature reading we got from each sensors in an ice-water bath at 0 °C, (b) the amount of noise in successive readings in the ice-water bath, and (c) conversion time for temperature measurements at nominally room temperature (measurements were actually performed anywhere between 0 and 30 °C). A high resolution version of the figure is available at images/Sensor_measurements_by_family.png. Data for (a) and (b) are typically based on 20 successive measurements taken once every 10 s after the sensor had equilibrated in an ice-water bath. Data in (c) are based on as few as a single measurement per sensor as in our experience conversion timing does not scatter, i.e. a single measurement is sufficient to assess the conversion time of a sensor at the current temperature.

Data are grouped along the x-axis as follows:

The Maxim-specified temperature error is ±0.5 °C at 0 °C, and this interval is marked in the plot (a) by thin dashed lines. We see that Family A1 sensors have readings typically in the range of -0.1 to +0.2 °C, Family A2 has -2 °C, Family B1 between 0 and -0.5 °C, Family B2 around -0.5 °C, Family C around 0 °C (not enough data points to say for sure), Family D1 between -1 and +1 °C or worse, and Family D2 -- well, it's difficult to say from the data: they started off really badly with performance similar to Family D1 and may or may not have improved since (would need to measure more sensors to say for sure). Measurements were taken once every 10 seconds to avoid artifacts from self heating of sensors contained in probes (i.e. we found that reading once a second increases the temperature returned).

An ideal sensors would only show discretization noise, i.e. have readings fluctuate between the two values that surround the actual temperature. This noise is shown in plot (b) as the standard deviation (std(T)) of nominally 20 temperature measurements. If all measurements are the same, std(T) is zero. If exactly one measurements differs by one discretization step (i.e. by 0.0625 °C) from the other 19 then std(T) is 0.014 °C, shown as the lower dashed line. If data are evenly split between two adjacent values then std(T) is 0.031 °C, shown as the upper dashed line. Data points between 0 and the lower dashed line indicate that more than 20 samples were used for that sensor, and data above the upper line indicate that readings fluctuated over a range of at least 2 discretization steps. We see that sensors of Families A, B, and C have essentially only discretization noise. In contrast, Family D1 produces shockingly noisy garbage (i.e. the actual measurement resolution is less than 12 bit), and sensors of Family D2 are also noisy at a level above the discretization noise.

The time required for temperature data conversion is specified as maximum 750 ms in the datasheet (12 bit conversion). The actual time required has (at a given temperature) a well-reproducible, characteristic value for each sensor. This time is shown in plot (c). Family A1 takes around 600 ms for a conversion, while Families A2 and B show a comparatively large inter-sensor variability. Families C and D1 are remarably fast at 30 and 11 ms, respectively, while Family D2 takes around 500 ms or a little less. Although all sensors we measured were faster than 750 ms at room temperature, some sensors of Family B got close to the limit.

Warning

Sending undocumented function codes to a DS18B20 sensor may render it permanently useless, for example if temperature calibration coefficients are overwritten [5]. The recommended way of identifying counterfeit sensors is to check whether the ROM does not follow the pattern 28-xx-xx-xx-xx-00-00-xx [5]. (While the ROM can be overwritten in Families B1 and D1 to mimic genuine sensors, we have not come across sensors with spoofed ROM [5].)

(Information on chips of Families A, B, C, and D comes from my own investigations of sensors in conjunction with the references below as indicated by reference number [1-6,8-10]. All tests were performed at 5 V with 1.2 kOhm pull-up. Decapping was performed jointly with Nga P. Dang, and measurements of temperature offsets and timing with Irina Sæther and Megan O'Sadnick.)

Sources

Sensors or probes with authentic or cloned DS18B20 were purchased from the follwing sources. Note that only sensors purchased from offical Maxim distributors are authentic chips that are guaranteed to have been handled correctly. Free samples provided by Maxim Integrated through their online ordering system are gratefully acknowledged.

Official Distributors: Maxim Integrated, Digikey, Farnell, Mouser, RS Components ebay: 5hk1584, alice1101983, alphago-it, andnov73, areyourshop-003, b2cpowershop2010, bernard_netelectroshop, binggogo, careforyou123, cheaptronic24, christians-technik-shop, czb6721960, d-9845, deepenmind, diy-arduino, diybox, eckstein-komponente, enigma-component-shop, e*shine, efectronics, ele-parts, fr_aurora, fzeroinestore, geekapparels, good-module, happybuddhatrading, hermann_shopp, icmarket2009, jk_parts, justpro, kingelectronics15, london_shoppings_1, lovesell2013, lucas89-8, makershop, mecklenburg8, modul_technik, moore_estates, nouteclab, *orchid, polida2008, puretek-innovations, rammie_74, scuary1, sensesmart, sensus, sevenshop888, shenglongsi, sparco888, survy2014, tancredielettronica, umtmedia, worldchips, xiaolin4, xuan33_store, yantzlf AliExpress: All goods are free shipping Store, AOKIN DiyMaker, Cuiisw Module Store, Eiechip, Fantasy Electronic, FSXSEMI, Great-IT, Great Wall Electronics, HWA YEH, Liyuan Electronic, Mega Semiconductor, Red Yellow Store, RoarKit Store, Sensor World, SHENGSUN Sensor, Shenzhen High Quality Products, shop912692, TENSTAR, WAVGAT, Win win., YLGA, YX Electronic Other: Adafruit, AZ-Delivery, Banggood, Taizhou Best Electric Equipment, Conrad Electronic, DFRobot, DROK, Elektroimportøren, Elfa Distrelec, Shanghai Jiutian Automation Equipment, Kjell & Company, LCSC, Dongguan Nangudi Electronics, Quest Components, Shenzhen RBD Sensor Technology, Reichelt Elektronik, Shenzhen Senstech Electronic Technology, SparkFun, Tayda Electronics, TELMAL, Dongguan Tianrui Electronics, YourDuino

References

  1. DS18B20 "DS18B20 Programmable Resolution 1-Wire Digital Thermometer", Datasheet 19-7487 Rev 6 7/19, Maxim Integrated.
  2. DS18S20 "DS18S20 High-Precision 1-Wire Digital Thermometer", Datasheet, Maxim Integrated.
  3. AN4377 "Comparison of the DS18B20 and DS18S20 1-Wire Digital Thermometers", Maxim Integrated
  4. AN247 "DS18x20 EEPROM Corruption Issue", Maxim Integrated
  5. Own investigations 2019, unpublished.
  6. Petrich, C., M. O'Sadnick, Ø. Kleven, I. Sæther (2019). A low-cost coastal buoy for ice and metocean measurements. In Proceedings of the 25th International Conference on Port and Ocean Engineering under Arctic Conditions (POAC), Delft, The Netherlands, 9-13 June 2019, 6 pp.
  7. Contribution of user m_elias on https://forum.arduino.cc/index.php?topic=544145.15
  8. MAX31820 "1-Wire Ambient Temperature Sensor", Datasheet, Maxim Integrated.
  9. DS18B20 "DS18B20 Programmable Resolution 1-Wire Digital Thermometer", Datasheet 043001, Dallas Semiconductor, 20pp.
  10. DS18B20 "DS18B20 Programmable Resolution 1-Wire Digital Thermometer", Preliminary Datasheet 050400, Dallas Semiconductor, 27pp.
  11. Piecemeal from various blogs and posts.
  12. QT18B20 "QT18B20 Programmable Resolution 1-Wire Digital Thermometer", Datasheet Rev 061713, 7Q Technology.
  13. AIR6273 "Terms, Definitions, and Acronyms Counterfeit Materiel or Electrical, Electronic, and Electromechanical Parts", SAE Aerospace Information Report, July 2019.
  14. UMW DS18B20 UMW DS18B20 datasheet.