Home

Welcome to the nobo wiki!

Reverse engineering the protocol between the thermostat and heater

• thermostat: NCU-2te
• heater: Nobo Fjord NFK4N-20 2000W

I disassambled the unit and identified the ground, power lines, and it was easy to spot the SCL, SDA text overlays.

The NCU and heater are communicating via I2C. I recorded the communication with Saleae logic analyzer. The NCU is always the master. There is only one master on the bus. There are two slave devices on the bus:

• The realtime clock placed on the NCU PCB
  • NXP PCF8523 realtime clock and calendar.
  • address 0x68
  • The NCU initializes the realtime clock, sets the date and time, weekday, etc.
  • it is irrelevant to me.
• The heater itself
  • address 0x01
  • I identified 3 different commands:
    • 0x01: set target temperature
    • 0x03: read environmentz temperature
    • 0x05: get heater state from the heater