Skip to content
csabigee edited this page Feb 3, 2024 · 5 revisions

Reverse engineering the protocol between the thermostat and heater

  • thermostat: NCU-2te
  • heater: Nobo Fjord NFK4N-20 2000W

I disassambled the unit and identified the ground, power lines, and it was easy to spot the SCL, SDA text overlays.

The NCU and heater are communicating via I2C. I recorded the communication with Saleae logic analyzer. The NCU is always the master. There is only one master on the bus. There are two slave devices on the bus:

  • The realtime clock placed on the NCU PCB
    • NXP PCF8523 realtime clock and calendar.
    • address 0x68
    • The NCU initializes the realtime clock, sets the date and time, weekday, etc.
    • it is irrelevant to me.
  • The heater itself
    • address 0x01
    • I identified 3 different commands:
      • 0x01: set target temperature
      • 0x03: read environment temperature
      • 0x05: get heater state from the heater

Get heater state, command 0x05

image

With this command, we can get the status of the heater. The heater is either ON or OFF. I observed thet the heater is using PWM to adjust heating power. The period of the PWM is 100 seconds.

NCU Heater
start condition
Setup write to 0x01 ACK
CMD 0x05 ACK
repeated start condition
Setup read from 0x01 ACK
NACK STATE 0x00 when the heater is OFF/not heating, and 0x01 when the heater is ON and heating
stop condition

Read environment temperature, command 0x03

image

The heater has a temperature sensor inside, at the very bottom, farthest from the heater element.

NCU Heater
start condition
Setup write to 0x01 ACK
CMD 0x03 ACK
repeated start condition
Setup read from 0x01 ACK
ACK B0 temperature in milidegrees °C, LSB
ACK B1 temperature in milidegrees °C, MSB
ACK B2 seems to be always zero
ACK B3 seems to be always zero
ACK B4 ??? different every time, could be CRC
NACK B5 ??? but I couldn't find what polynom
stop condition

Set target temperature, command 0x01

image

The heater is doing all the work to reach, and keep the target temperature. The NCU's job is to send the desired temperature. The heater is receiving the target temperature, valid from 7°C to 30°C. Also there is an OFF option, where the heater is letting the temperature to drop below 7°C.

NCU Heater
start condition
Setup write to 0x01 ACK
CMD 0x01 ACK
B0 ACK 0x08 when the device is set to a temperature, 0x0B when it is set to OFF
B1 ACK target temperature in milidegrees °C, LSB
B2 ACK target temperature in milidegrees °C, MSB
B3 ACK seems to be always zero
B4 ACK increases by 84 with 1°C target increase
B5 ACK decreases by 64 with 1°C target increase
repeated start condition
Setup read from 0x01 ACK
NACK STATUS 0x17 when setting is valid
stop condition