Your source for daily hacks

Published on: October 8, 2013 / Comments: 18

NEST Thermostat torn down and analyzed

What, no datasheet ?

Daniel has a curiosity that most hackers like him share.  And let’s face it, we like to take stuff apart.   Some time ago, Daniel seen a previous teardown of the NEST thermostat by the ifixit guys.  Inside there is an 802.15.4 radio transceiver that isn’t mentioned anywhere in the documentation this radio is commonly used in zigbee/xbee/mesh networks.

Daniel even went as far as to ask them what the radio was for, and got stonewalled.  So Daniel decided to do his own teardown and probe at the inner workings of the thermostat even further.  One of the goals was to see if the 802.15.4 radio was ever used without them saying so.

He notes at the end that the NEST guys have announced some new products like a smoke detector, and they have in the specs the 802.15.4 radio so it makes sense that the radio is there for future upgrades for the other devices to be able to talk, but I recommend watching the teardown video, it’s long but entertaining.

Check out the video after the break.  Also more info over at Daniel’s site.

  1. Peter says:

    Cool project. I have a display model from a retailer of the nest thermostat. It is “stuck” in demo. Any thoughts on being able to “hack” the software/firmware to enable it to be a normal funcitoning unit. I opened it up and all of the hardware appears to be there. It does not allow me to connect to a wireles network in demo mode. Thanks.

  2. WP says:

    Interesting, would have been better if the video was in focus, couldn’t see a thing.

  3. Shawn says:

    I too have a demo unit that is stuck in demo loop. I thought for sure it could be opened up to operate properly, but alas i cannot figure out how. Not much help plugging it into a computer via usb as that shows up one file, if you delete such said file it just re appears next time you connect it.

    Would sure love to know if this unit can be made to function correctly too.

    • Shawn says:

      Its a shame cuz I have about a dozen of these from demo displays that were going to be thrown in the electronics recycling bin. i was hoping to save them from such a fate.

      • The Hackalizer says:

        Sounds like the demo unit has some demo firmware on there but otherwise is probably a functioning unit. If you could get your hands on the retail firmware and flash it (it’s flashable by usb, just plug in as mass storage and drop on it and reboot) — It might work. Otherwise it shouldn’t be hard to get some open source firmware running on this thing. It’s just embedded linux with a ti omap processor.

    • I am testing a demo unit later today with some firmware… I’ll let you know how it goes.

      • shawn says:

        I did dig into my demo unit a little further. Hoping to find a jumper or solder point that would engage the demo loop.

        My thought was that all nest units come with this demo software on them, and that units that actually make it to demo have this software engaged somehow.

        Let me know what you find!

        • The Hackalizer says:

          Let’s just say I got bored and got a present for you guys. It’s not the latest version but I got a retail firmware for you. Going to email you.

          • Peter says:

            Cool, thanks.

          • Shawn says:

            Thanx for the files! I have tried a few drag and drops, none seem to
            work. I detail what i have tried thus far:

            Each attempt I have deleted the “technical info” .plist file from the nest.
            -add entire .tgz file – failed

            Extract .tgz file to reveal .nlsw folder
            -add entire folder – failed
            -add nlbpfirmware.plist – failed

            Am i tracking on the wrong ideas here? (Sorry, I am low voltage techy,
            not so computer techy)

            If anyone can steer me in the right direction with a little more
            instruction that would be a huge help……..

            Also, if it helps you,

            Every time I plug the unit back into computer, or it reboots and so on, once I get back into the unit the “technical info” file is gone, and any files I had placed on the memory are gone.


          • Bob says:

            I would love to get a copy of that firmware. Me and a coworker each got one of these demos. Can you help us out?

          • The Hackalizer says:

            The word is that the retail firmware on the demo unit didn’t work. I suspect the demo unit silently rejected the upgrade, so it would be a matter of re-generating the signature or flashing a different method than via USB.

          • shawn says:

            I agree. After I would delete the old file and replace with the new file, once the unit rebooted it would say “updating firmware ” and would revert to its original programming. I dug around looking for hidden files, but could not extract anything else. At this point I’m don’t with the units. I have one to my buddy to hack on, let you know if he garners any results.

  4. Shawn says:

    Sorry, need to edit that last post. The “technical info” file reappears after each attempt………

  5. Nav says:

    hi, i recently stumbled upon a demo unit as well, i have a Nest-Learning-Thermostat-3.0.5-diamond.tar file i found on the web; however, im running into the same issues as Shawn.

    Was wondering if there were any updates or successful boots.


  6. Joel says:

    Hi, I have first gen nest with demo loop. Has anyone figured out how to get rid of that yet. Right now it’s a fancy paper weight on my desk.

Leave a Reply to Shawn Cancel reply

Some HTML is OK