Taking Apart the Honeywell Thermostat

Written 2015-04-27

Tags:KCPL Honeywell Atmel Atmega 

I have a thermostat

It was made by Honeywell, and it came with my house. It is also in daily service without a hot spare, so I have been waiting since last fall to do this teardown.

What is an energy optimizer?

My electricity provider offers a sweet deal where they give you a free programmable thermostat, in exchange for their gentle adjustment of your temperature during peak usage. This implies some sort of communication link between my house and their systems.

What is inside?

One assembled thermostat, front

Honeywell Thermostat Teardown

One assembled thermostat, back

Honeywell Thermostat Teardown

We can see three subsection of the device. In the center is the umbilical to the home. On the left is a small antenna. The rest of the PCB is covered by the frame.

What is under panel number one?

Honeywell Thermostat Teardown

Under a pair of plastic clips we find a small PCB fitted to the main PCB

What could it be?

Honeywell Thermostat Teardown

Interestingly, this appears to be the radio section of the device. We find

  • at least four crystals or oscillators
  • a seemingly unused 10 pin header, possibly for initial programming
  • ST M24256 EEPROM
  • LTWC455E six-element ceramic filter
  • CDBC C28 ceramic discriminator
  • 4 pin header going to the main PCB
  • USB mini connector although it is not routed for USB
  • ta31149 FSK detector
With the above parts list, this has got to be our radio.

Where does it go?

Honeywell Thermostat Teardown

Simple enough.

Seven more clips to go

Honeywell Thermostat Teardown

Five clips hold the front bezel on.

Last two clips unclipped

Honeywell Thermostat Teardown

Here is the full rear PCB

Anything under the LCD?

Honeywell Thermostat Teardown

No, not really, just a light-spreader.

Back of the LCD

Will it run without the radio?


Yes, yes it does.

What is next?

Next would definitely be tracing out the connectors on the radio PCB. Honeywell also makes a WiFi version of this unit, which I suspect is the same but with a different radio PCB. The four-pin connector appears to carry power and ground, leaving two signals for a data bus.

WiFi Yagi SWR Shootout

Written 2015-04-19

Tags:IT-24 WiFi HSMM Ham Radio RigExpert 

Today I traveled down to Heritage Park. With a pond and trails, it is the nearest public space without much RFI I can use for testing antennas. Also, I managed to acquire quite a few cheap 2.4GHz yagi antennas from China. These can be found on eBay for between 8 and 20 USD.

The Setup

Without an anechoic chamber, I'm a little limited to how I can do my testing. The antenna under test is mounted at the end of a wooden 1x1 beam. The beam is mounted to a picnic table with clamps, holding the antenna 16 inches away from the table and parallel with the table.

The Setup

Measurements are provided by my RigExpert IT-24, using the python image scraper I reverse engineered earlier. The self-calibration was executed a few minutes before beginning the test.

The Meter

The Competitors

I have three styles of antennas, labeled A, B, and C.

The Competition
  • Type A consists of a short coax pigtail, running into a plastic enclosure with a small metal dipole. I suppose they hoped it would resonate with the other elements on the boom.
  • Type B consists of a longer coax pigtail, running into a cylindrical plastic housing, with a loop around the body of the antenna, and some component heat-shrinked inside the loop. My assumption is that whatever components are inside the heatshrink provide an impedance match.
  • Type C consists of a longer coax pigtail, running into a cylindrical plastic housing, with a loop around the body of the antenna, but no components under heatshrink.


Standing-Wave-Ratio, or SWR, is the ratio of either voltage(VSWR) or power(PSWR) transmitted into an antenna to that emitted. SWR can vary wildly between different frequencies, so the IT-24 includes a feature to plot the SWR of an antenna across a range, specifically between 2.3GHz and 2.6GHz, or some subsets of that range.

High SWR can come from a variety of sources, from bad cables, to poorly designed antennas, to poorly controlled component part tolerances, to a bird nest. Antenna design is a system problem that tends to affect every antenna of that design. Part to part variances tend to indicate production, supply, or quality-control problems. Bird nests will be an ever-present installation location hazard.

Additionally, good SWR can come both from the antenna efficiently transforming electrical signals to radio signals, but it can also come from high-loss cable, where the transmitted power is simply eaten by the cable before it hits the antenna.

a1_wide a1_narrow A1
a2_wide a2_narrow A2
b1_wide b1_narrow B1
b2_wide b2_narrow B2
c1_wide c1_narrow C1
c2_wide c2_narrow C2
c3_wide c3_narrow C3
c4_wide c4_narrow C4

The Results

...are surprising. The three designs vary wildly, but none are very stable over frequency.

Type A


This is just not a good antenna - the SWR meter was pegged, so this antenna will always reflect at least 80 percent of the signal instead of transmitting it to the air. This also means it will receive less than 20 percent of any signal. The IT-24 can measure SWR up to 10:1, but this antenna is so bad I won't even try. I do notice that the coax is secured with a zip-tie, that seems to crush the coax. If there coax were crushed to the point where the shield and center conductor touched, it would certainly return a bad match, but anywhere in-between good coax and crushed coax will likely increase SWR somewhat.

Anyhow, these are garbage and will be discarded.

Type B

We have a winner, but I think they could be better.

Antennas B1 and B2 both have 2 to 1 SWR or better across the WiFi range.

However, averaged over frequency, B1 is noticeably better than B2. Good quality antennas will perform similarly in similar circumstances.

Also, the frequencies with low SWR are different between the two samples, which indicates some tolerance or variability in the design, or perhaps in the test.

I am very curious what magic lurks inside the heatshrink, although with only two samples, it is unlikely one will be sacrificed.

Type C

Welcome to funkytown. These antennas are odd.

First, the cable is 75 ohm, but the IT-24 is a 50 ohm device. It is possible this was a design choice, as 75 ohm cable tends to have lower loss than the equivalent 50 ohm cable, and if the cable is long enough, you can come out ahead by eating a single mismatch loss, but saving on the loss of the cable itself. It is also possible 75 ohm was chosen because it tends to be cheaper.

Next, we see high variance in SWR over frequency. This isn't necessarily bad, as long as the high SWR frequencies are outside of our operating range. But in this case, they do impact the 2.4GHz band.

And, just like the Type B antennas, the variance in SWR is not stable from one antenna to another. But unlike the Type B, where frequency varied SWR between 1 to 1 and 2 to 1, the Type C varies between over 5 to 1 and 1 to 1. This means that each of the four Type C antennas tested will have very different efficiencies on different channels of WiFi.


The three designs tested have very different operating characteristics. Although the eight antennas tested are not enough to be statistically significant, I will likely select Type B for future usage and testing. Type A will be discarded, and Type C may be used based on the channel needed.

Future Work

The next thing to test is how well each antenna can receive signals from a known test transmitter. Since I don't have a calibrated antenna, all tests would be relative to the gain of the antenna used on the transmitter and would have no use outside of comparing the yagis to each other. However, there are storms approaching, so there will not be time to do this test today.

Taking Apart the Monoprice Wireless-N Router

Written 2015-04-13

Tags:Teardown Monoprice Wifi Realtek 

Today I take apart a Monoprice Wireless-N WiFi Router.

Here's the packaging
Monoprice Wireless-N Router

What's in the box?
Monoprice Wireless-N Router

If you flip it over, there are four screws under the feet.
Monoprice Wireless-N Router

After removing the screws, the rear case flips off easily - no plastic catches to be found.
Monoprice Wireless-N Router

Here's the PCB. It has Seems like the console is J15, just northwest of the CPU. From pin 1, the pinout goes power, ground, serial, serial.
Monoprice Wireless-N Router

Vizio Remote Teardown

Tags:Teardown Vizio Remote Television 

One day, my friend genpfault came over to build some model aircraft, and for various reasons we decided to teardown my television remote.

The external frame consists of a front and back face, a battery door, and two button grids. The front and back faces are held together with snap clips that are easily opened with a plastic butter knife or a spudger.
Vizio Keyboard Remote

Inside we find two PCBs connected with a single power cable. each PCB has its own power filtering capacitor, but as we shall see in a few photos, this is a very simple design.
Vizio Keyboard Remote

Remote PCB. I suspect this may be shared with my non-keyboard remote.
Vizio Keyboard Remote

Keyboard PCB. This circuit is entirely separate from the remote PCB, except for two wires providing power.
Vizio Keyboard Remote

Installing Google Earth on 64 bit Debian Jessie

Tags:GoogleEarth Google Debian 


Due to the multiarch transition, a package, ia32-libs, is no longer included with Debian-Jessie. Google-Earth depends on this package. This post will show you how to remove the dependency and produce your own deb file without it. Interestingly, Google-Earth appears to be built in 64-bit mode, so ia32-libs shouldn't be needed.


  1. Pull down the latest direct from Google.
  2. Extract it with "ar vx google-earth-stable_current_amd64.deb". This should produce the following files:
    • debian-binary
    • control.tar.gz
    • data.tar.lzma
  3. extract control.tar.gz with: "tar xvf control.tar.gz". This should unpack the following:
    • prerm
    • postinst
    • postrm
    • control
  4. Open control in an editor and remove ", ia32-libs" from the Depends:" list
  5. Repack control.tar.gz with: "tar cvf control.tar prerm postinst postrm control && gzip control.tar"
  6. Repack the deb file with "ar cr ge-noia32.deb debian-binary control.tar.gz data.tar.lzma"
  7. Install the deb file with dpkg: "dpkg --install ge-noia32.deb"
  8. Run google-earth from a command-line to make sure you aren't missing any dependencies. If launching reports an error about finding a library, you'll need to install the corresponding debian version


Until google updates their package or someone adds an ia32-libs to Debian Jessie, you'll have to uninstall google earth, then pull down the latest, then patch it for each revision.