DIY RadioThermostat Wifi Module

PRECEDENCE

The USNAP Wifi Radiothermostat module is known to drop off the network (nuisance) and has apparently been simulated (replaced with) a ESP32 device.

QUESTIONS

I am wondering:

  1. if there is any documented results, code, bill of material, etc. to reproduce the result.

  2. if the thermostat JSON API is built in to the thermostat or the wifi module?

  3. What exactly is the protocol sent between the thermostat and wifi module?

The exercise is greatly simplified if the wifi module is simply forwarding JSON instructions to the thermostat.

I have begun to ask questions and will continue to add questions:

https://chatgpt.com/g/g-p-69f7590a9a188191a7356459c924eaf9-diy-wifi-radiothermosta/project

USNAP Pinout Per Google:

CEA-2045 Pinout Table [1]

The interface commonly uses a line voltage connector or a specialized low-voltage connector, designed to allow “first make/last break” for safety (ground-first). [1]

Pin [1] Name Description
1 Line (L) AC Line Voltage (Power)
2 Neutral (N) AC Neutral
3 GND Ground/Safety Ground
4 Reserved Reserved for future use
5 D1 Signal/Communication Line (e.g., RS-485)
6 D0 Signal/Communication Line (e.g., RS-485)
7 V+ Low Voltage Power (if applicable)
8 COM Common/Return (if applicable)

The reddit thread ended abruptly, so not clear if the solution listed there was real or not. If it was real, there doesn’t appear to be anything written down about it.

I did find some documentation on the API the Wi-Fi module provides:

If you have the thermostat and the Wi-Fi module it should be possible to reverse engineer the protocol it uses to talk to the thermostat.

Since the thermostat is designed to work standalone, I would expect that the Wi-Fi module sends commands to the thermostat to change its behavior. That might be JSON or it might be a more compact binary blob that you would need to understand (or perhaps just copy).

But, I have to ask why?

I remember when these thermostats were popular. I thought about buying one, but never did. The industry has moved on. A lot changes in a decade.

An old review: https://lowpowerlab.com/2015/10/29/radio-thermostat-ct-50-review-and-install/

That is where I found the API documentation.

This is not an easy project. It might be fun, but if you value your time above $0/hour, you will come out ahead with a new thermostat.

1 Like

I have 11 thermostats IN SERVICE:

  • 2 CT80 (Radiothermostat)
  • 4 CT50 (Radiothermostat)
  • other

COMMENTS:

  • I’d like to have the fleet standardized on the CT80 because it measures humidity AND now relatively inexpensive, but they do not come with Wifi modules.

  • Reliable DIY wifi modules would be useful twofold due to their scarcity. The existing wifi modules frequently disconnect to the network, despite have an AP within 5 feet line of sight. A reliable DIY wifi module would persistently try to attach to an AP when it is powered on.

It sounds like you have both the thermostat and at least one Wi-Fi module.

You have some data on the interface. This is about the amount of information I had on my previous HPWH. I used my voltmeter to measure the voltages on the various pins to make sure I didn’t destroy my logic analyzer.

Once I confirmed the voltages were within range of my logic analyzer, I hooked it up to see if I could make sense of the communication. It didn’t make sense at first. But, then I realized it was using 9-bit serial. With that, I was able to use a terminal emulator to capture the very chatty protocol. It then took some patience to figure out the interesting bytes.

I didn’t buy the Wi-Fi controller, so it took longer to understand what the data meant. Since you have a controller, you should be able to figure it out quicker. Unless, it is using some kind of encryption (but probably not, since it is so old).

I have four new CT80s inbound without Wifi modules.

@ NeelMalk:

  1. Is the voltage 3.3?
  2. What is the pinout?
  3. What is the serial protocol between the wifi module and the CT80? 8n1 9600 Baud?
  4. Is the Wifi module merely a send/ receive device? or does it store information (cooling / heating schedules)?

Thanks for doing the work and sharing the results.

I don’t have the thermostat or the Wi-Fi module. The work I did was for my prior water heater, so not applicable to your thermostat. The process I used might work. It typically requires patience and the ability to solve puzzles and/or see patterns. I suspect AI might be able to help. AI didn’t exist yet, when I did it.

As for #4, I can report that the wifi module doesn’t store anything, it’s just a network interface. (Well, ya, it remembers its MAC . . .)

I’ve also found the easiest way get get a usnap wifi module for the ct80 is to buy a ct30 (or the Filtrete branded version) with one installed and cannibalize it.

1 Like

Im also looking to keep my CT80's running. While search around i came across this doc.
https://fccid.io/QO8-WIFIG0325/User-Manual/User-Manual-1293857.pdf

Page 4:

The module has a 10 pin connector conforming to the USNAP standard with the
following functions:
Pin Signal
1 SELECT*
2 ATTENTION*
3 SCLK
4 MOSI
5 MISO
6 RESET*
7 +3.3V Power
8 Signal Ground

I plan to connect an esp32 to tap into the communication between the module and the thermostat. That is, as soon as i find the best way to do this.

That looks like reasonably straightforward SPI. I would use a logic analyzer (with SPI decode) to reverse engineer the protocol.

There is this project that you could try: Building an SPI Sniffer for ESP32 | Details | Hackaday.io

or this: EEVblog Captcha

I have one of the original Saleae Logic analyzer (back when they were pretty cheap) and also a Pro 8 (which you don't need for this).

If you are not doing this professionally you can get one for half price (but still not cheap)

Thanks for the info.

The other night, I was able to pull raw data from between the two devices.
Now the hard and/or hopefully fun part, making sense the of data(framing and whatnot..)