So, parts 1 and 2 showed that the Tado gateway could be debugged and re-purposed. What about the main Thermostat unit? That contains a MSP430F5659 rather than a Tiva. It also has a CC1101 sub-1GHz radio. There’s 2 Panasonic DK series latching relays to switch the heating and hot water – DK1a1b-L2-3V to be precise. Along with that is what I assume to be a switching power supply so it is powered by the mains and a 1.0F supercapacitor – probably to keep it working if this is briefly switched off. Finally there’s a Sensirion SHT21 temperature and humidity sensor – no thermostat would be complete without a temperature sensor! Whilst the MSP430s have an on-board temperature sensor these get heated by the processor itself so aren’t really much use.
Connecting a debugger
Well, just like the gateway, there was a very inviting 12 pin header – this time 0.1″ pitch through hole. It turns out this is a standard 14 pin MSP430 JTAG header with the unused pins 13 and 14 missing. Another result. Adding the header and connecting this up to a MSP-FET was all that was needed. Not the missing pins on the new header (on the RHS). That’s just to remind me to align it properly with the 14 pin ribbon cable.
The MSP430 is actually on the reverse of the device, but to be honest that’s the only interesting thing there. Want a look anyway? OK then. Here it is.
The first thing I did was use MSP Flasher to verify it could connect to the MSP430 and then dump the sections of the ROM that I might want to put back. There’s MAIN (code), INFO (configuration and calibration), BSL (this was all 0xFFs anyway). I dumped the RAM too just in case. These need to be backed up to separate data files. Apart from one tiny bit of plastic that needs to be trimmed you can even get it back in the case with the header in place. Same with the Gateway.
CC1101, relays, buttons, LEDs
Next I need to work out what pins connect to the peripherals..
0xFRED 