User Tools

Site Tools

Trace: hacking_an_eq-3_model_n

Hacking an EQ-3 Model N

The EQ-3 Model N (2-language user manual) is a radiator thermostat which tries to be better than mechanical counterparts. To some extents it certainly is, it has a clock built in and allows to program temperature changes (7 changes for each day of the week). There are similar models with built in Bluetooth and other fancy stuff, too.

How the Model N Looks Inside

Here are a few pictures from inside the device. After pulling out the dial wheel on the front (it's a snap requiring some force) and removal of 4 Torx screws found under the battery hatch it can be taken apart easily.

Take care of the display, it simply falls out when opening the housing. It can be seated back easily later, but only if it didn't break when it fell down to a concrete floor.

This is the Model N as it comes out of the box.

This is the Model N as it comes out of the box.

The same with housing removed.

The same with housing removed.

Looking from the side, one can see the valve actuator. The slightly hidden tin can is a simple DC motor, driving the gearbox right of it. The right end of the gearbox is to be mounted on the radiator valve.

Looking from the side, one can see the valve actuator. The slightly hidden tin can is a simple DC motor, driving the gearbox right of it. The right end of the gearbox is to be mounted on the radiator valve.

This is the circuitry board of the Model N. No components other than the dial encoder on the back side. Noticeable dirt on this brand new device. For details, see the following description.

This is the circuitry board of the Model N. No components other than the dial encoder on the back side. Noticeable dirt on this brand new device. For details, see the following description.

Actuator Motor

A simple DC motor running on full battery voltage, which is about 3.2 volts. At motor start, voltage is 100% PWM for a few milliseconds, then only 80% PWM. PWM frequency is about 200 Hz.

Current consumption without load is about 13 mA. With gears fully blocked it can go up to 40 mA, but then some overload protection kicks in. Looks like motor current detection is used as kind of endstops to find absolute position of the drive. During initial calibration the Model N moves as far as it can in both directions.

On the left side of the PCB a number of parts hint on a H-Bridge. Actuator motor is connected with the black and red wire soldered onto the board.

Circuitry

At the center one can see the dial wheel encoder. Two big solder points for mechanical fastening, three blobs of solder bottom left of the center for the encoder signal.

Microprocessor (MCU) is a STM8L052C6 (8-bit CPU, 48 pins). This chip features a LCD driver on-chip, so most tracks on the PCB go to that LCD. On the outer right of the PCB is PRG1, which looks very much like a programming connector. No attempts to read or write the MCU were made, though.

Mechanical buttons TA1, TA2, TA3 for the user interface. TA2 is for the dial wheel, which can be pressed.

Temperature Sensor

Temperature sensor of the device is a 10 kOhms thermistor. It's R4 at the bottom center. Yes, it's SMD, so it likely measures more PCB temperature than room temperature.

Measuring the thing isn't trivial, because it isn't supplied with voltage most of the time. It's a battery supplied device, after all, so wasting a mA or two all the time is indeed not a good idea. BTW., the Model N refuses to pick up normal operations without a successful calibration movement, so you have to mount it on an actual radiator valve at least once.

It looks like the thermistor is connected via R5 to pin 32 of the MCU. Looking at the STM8L052 data sheet, this is about the only pin which makes sense.

Measurement Points

There are several measurement points located on the PCB. These appear to be:

MP1: Menu key. Zero volts pressed, else 3 volts.

MP2: Dial wheel key. Same behaviour as MP1.

MP3: Thermistor voltage. To measure the thermistor one can measure between MP3 and MP6 with an ohms meter.

MP4, MP5: Dial wheel encoder signal.

MP6: Ground. Maybe pointless, but it's just GND.

Goal of the Hack

One of the drawbacks of this model is the temperature sensor built right into the housing. Openings for ventilation are really tiny. As such it likely measures not only general room temperature, but room temperature right next to the radiator, mixed with the temperature of the radiator valve. Measurement precision could be better.

Everything electronic? Heck, then let's rip the sensor out and connect it back with a pair of long wires. This way, temperature can be measured anywhere. Sounds easy, right? With some soldering skill it pretty much is!

The Hack in Pictures

During the modification a lot of pictures were taken, so let's speak these.

First step is to remove the Thermistor. Try to heat it on both sides, then shove it away.

First step is to remove the Thermistor. Try to heat it on both sides, then shove it away.

Then solder a wire to each of the pads. Requires lots of flux and a steady hand :-)

Then solder a wire to each of the pads. Requires lots of flux and a steady hand :-)

Drill up one of the venting holes in the battery cover. Wires will go through here.

Drill up one of the venting holes in the battery cover. Wires will go through here.

Then make a knot into the wire pair and run it through the cover hole. This means to be a stress relief, so you don't rip the circuitry apart if you accidently trip over the wire.

Then make a knot into the wire pair and run it through the cover hole. This means to be a stress relief, so you don't rip the circuitry apart if you accidently trip over the wire.

After doing the wiring on the PCB side, solder the thermistor removed earlier back onto the other end of the wire pair. Again, this might take a few tries.

After doing the wiring on the PCB side, solder the thermistor removed earlier back onto the other end of the wire pair. Again, this might take a few tries.

As you might mount the thermistor to some metallic surface, insulation of that is a good idea. This is Kapton tape, but its high temperature resistance isn't needed here.

As you might mount the thermistor to some metallic surface, insulation of that is a good idea. This is Kapton tape, but its high temperature resistance isn't needed here.

Assemble everything back together and you're done. That's how the EQ-3 Model N with DIY'd external thermistor looks like.

Assemble everything back together and you're done. That's how the EQ-3 Model N with DIY'd external thermistor looks like.

With all this done, the Model N works just as before, just room temperature can be measured on a more meaningful position.

How the Result Works

The modification turned out to work just fine. After confirming this, the thermistor wasn't mounted in the room somewhere, but connected directly to the ISTA consumption counter of the radiator. And the Model N didn't like this, the valve fully opened and closed every few minutes. For whatever reason. Hard to say, because it's Closed Source, so reprogramming the microprocessor wasn't a realistic option.

This eventually led to development of the ISTAtrol, which uses the mechanical actuator of the Model N, but in combination with a DIY'd controller and Open Source firmware.

hacking_an_eq-3_model_n.txt ยท Last modified: 2018/05/27 16:10 (external edit)