Nest Teardown
by Nate | November 29, 2011 | 57 comments
Skill Level:
Beginner
Awhile ago I read about Nest, a newfangled thermostat with a color display and some interesting 'learning' techniques for keeping your home warmed or cooled, as sensible as possible. Did I mention the beast has IR proximity, PIR movement, humidity, magneto scroll, and a mini USB connector? Oh. It does.

It's kind of awesome, but it comes at a price. Pre-orders were $249 + shipping but I'm a sucker for new technology so I got in line. A few weeks after I placed my pre-order I got a piece of spam email from Nest offering a free professional installation. That's great, but I was not planning on my Nest ever seeing the light of day - I wanted to take it apart and see how it worked. So on a whim, I replied to the email:
Hi Matt,
This offer is a great idea! I feel very much appreciated as a customer but I won't need an install, thanks! I can't wait to get my nest and poke around inside. Depending on what's inside it might be worth doing a homepage post. Would you mind?
From your friends at SparkFun,
-Nathan
Much to my surprise and honor, I got a response from Matt:
Thanks for the note Nathan! I'm a frequent shopper of SparkFun myself.
No way! The founder/VP of engineering responded?! Thanks Matt! And you know of SparkFun? Very cool. We even got a semi-green light to post a tear down. This is a refreshing difference from some other companies we have emailed in the past. When I received the Nest shortly after Thanksgiving, I set out to tear the beast apart.
Disclosure time: We didn't get Nest for free. This teardown was purely the result of Nate ordering stuff late night when he probably shouldn't be.
After tearing apart the Nest then re-assembling, it actually continued to function (a first for me!). I was so impressed with the thing that I stayed up way late to document the tear down. I have nothing but very positive things to say about the hardware design, website design, and user interface design of the Nest. It's slick. Really slick. I consider myself an amateur when it comes to consumer electronics so take this review with a grain of salt. But whoa - I just turned off my heat while writing this tutorial! Welcome to the future.
The packaging of the device is on par or above what one would expect for $250 - I even got a Nest branded screw driver. Neat. But we are not here for a packaging review now are we?
Here's the nest shortly before meeting the business end of a Phillips head screw driver. Did I mention they included their own disassembly tools? They get a +1.
The camera was playing funny reflections with the glass and the apertures. Here we can see where the IR LEDs and sensor are exposed.
Back side. If you've read some of my other tutorials, this miniUSB connector is completely surprising! Thank you Nest for including an external connector. I don't want to completely hack/reprogram/re-purpose the thing today, my goal is just to show off the internal hardware. But by making it easy to plug in you are opening the door way to good things.
This thing has an internal LiPo battery? Really? 2.1Wh over 3.7V = around 567mAh battery. That's fairly sizable for a thermostat. My guess is that the unit may need more power than the HVAC wiring can provide when Wifi is broadcasting and the display is on. The LiPo acts as a very large capacitor.
Here we have the head unit on the right. In the lower left we have the first layer of the housing - the bit that actually attaches to the wall. This includes the user press-able button as well as the 8+ connector to the house wiring. When you snap this thermostat to the plate on the wall, there is a multipin connector that connects through the first layer to the head unit. That said, there's an awful lot of exposed gold pads on the first layer. I'm not entirely sure what they are there for but my first impression: This thing is extremely well designed and produced. The ribbons, connectors, battery, and hardware are all of very high quality.
Hi Fish. Must be the manufacturer?
Up close on the head unit. Note the three wires coming from the battery: 3.7V, GND, and what else? A temperature sensor on the battery? A third wire on a LiPo is sort of odd for such a low current application.
A few things are cool here. Note the IC in lower left. I don't know what that is! It is facing towards the wall when the Nest is installed onto the wall. It doesn't read the dial, proximity, motion or anything I can fathom but it's a clear epoxy encased IC which usually indicates visible spectrum or light (IR) sensing - but why is it pointing at the wall? A dust sensor? Humidity? Nah.
Also you'll notice three Phillips head screws holding a small board south of the LiPo in place. That is the PIR. The small daughter board is powered and sensed through the screws (three screws = VCC/GND/Signal). I've seen this technique before but I'm not sure what they used it here. Perhaps it's because three screws are cheaper than three screws and a 3-pin connector.
Here is the PIR removed. The IC reads XLitos. Used to detect motion in a room.
Check that out! I've seen magneto sensors like this before on the trackball for the Blackberry Pearl. We used the same type of sensors for the Trackballer Breakout. I am assuming these two sensors are reading the notches on the dial via magnetic field but I could be wrong. I love how they used a very tiny vertical board. This is one heck of a design, all for a thermostat!
The included Phillips screw driver got me this far, at this point I had to break out the Torx bits.
Note the high density connector on the left. It was something like 40 pins in a tiny ribbon cable. Look closely if you need to know how to flip up the connector to release the ribbon.
Here we can see the main board covered in a massive RF shield (and my thumb print). Is it cheaper just to throw a metal shield on everything than to risk FCC testing failure? Also note not one but two antenna connectors. It's odd to see external U.FL connectors on the board. They must be there for ease of testing? Next to the connectors you should see some gold clips. These actually make a compression contact to the dual flexible antennas embedded into the face of the unit.
Although I failed to capture them on the camera, there was two flexible PCB antennas in a vertical configuration. One antenna was marked 'Zigbee'. Now this has my interest piqued. I assumed there was two antennas for better reception but perhaps one antenna is Wifi and one antenna is for something else? Zigbee? No way. Really? Could Nest be planning on adding other equipment control such as lighting or refridgeration? After using the Nest and its accompanying website, I certainly hope so.
Here's what we were waiting for. This is an astronomical amount of silicon for a thermostat!
Here are a few shots in case folks want IC identifiers.
I haven't looked any ICs up yet.
But they should be out there.
This is the back side of the main board. Note that this was completely covered up with another RF shield. That seems odd to me as there isn't much here but decoupling and another anonymous IC that has been bonded to the PCB. Did Nest really believe there would be that much mechanical shock and vibration that they bonded every IC to the PCB?!
Here is a view of the inside front face. You can see that they covered the lower small aperture of the face with the characteristic PIR prism material. Checkout our motion sensor for a comparison. Ok, now take a step back and try to remember where all the screws, ribbons, and clips go. Astonishingly, the unit went back together within a few minutes - another mark of incredible DFM (design for manufacture).
After re-assembling I plugged in a miniUSB cable. After running a series of interesting characters on the display, I got this message - 'Please attach the display to its base'. Booo.

But the unit did come up as a Mass Storage Device!

Who wants to use their thermostat as a 38MB jumpdrive? I do! I do!
Now it was time to actually wire the thing to my existing HVAC wiring and mount it to the wall. This was really easy and straight forward. Well, except for the fact I was too lazy to spackle and paint over the spots where the old, much larger thermostat lived. So I'll just take some really dark pictures so you can't see the holes in my wall:
Configuring the device was surprisingly easy. Interfacing with the device via the dial is a dream.
Once connected to Wifi, Nest needed an update. Look closely for the pinkish dot in the upper left area. I took this photo with my cell phone so that you can see the IR LEDs triggering. It didn't come out well but it's fun to see through the camera of a cell phone.
Nifty.
The thing that really sealed the deal for me was when I went online to connect to the thermostat over the internet. To activate the new thermostat onto remote control you have to create a login to Nest.com. Creating my new account was the most basic and best account creation I have ever done! It was as simple as providing an email address and a password.
Next, the web page told me it detected a new thermostat near by. Cool! To verify it had the right one, I needed to go over to my newly installed thermostat and hit the button to confirm that my thermostat was indeed the one attempting a connection. This makes sense - it's a simple handshake confirmation of unique IDs. However, when I walked downstairs the thermostat was off. As I approached it I cannot describe to you how amazing the feeling was when the display slowly came alive saying 'Would you like to connect this thermostat to nathan@sparkfun.com?' - why yes, yes I would. I know it's just the IR prox detecting that I'm near so the display kicked on, but it's the polish of these ease-of-use steps that make this a really nicely designed product.
To sum up, Nest is a $250 thermostat. It may be not for everyone, but for me, it's exceptionally easy to use and alleviates the nightmare of programming a thermostat. I can even same some money by turning down the heat when I'm on the road. Nice job Nest.
Comments 57 comments
Hmmm, interesting. Wonder what OS it is running, Linux? Anyways have some interesting links:
CPU It’s an ARM CPU in that thing!
RAM (Can’t find anything but a product selection PDF that says its a 512Mb (assuming mbit) 32M x 16 MDDR 1.8v 60 pin fbga)
ROM (Google, shame on you, you failed me on this)
Power Management A power management chip in a thermostat? Whats next?
Battery charger LiPo USB charger, move along.
Zigbee Transceiver
Zigbee SoC
Wireless module (can’t find anything that would seem like it from looking up the numbers on it)
Thanks for digging up some datasheets. This reinforces the ‘Nest will do something in the future with Zigbee’. I wonder where they are headed…
No problem, I have a habit of grabbing random things around my room and opening them and just looking up the chips in them.
Nate, great article.
Nest is definitely a “trojan horse”
The WiFi/Zigbee connection will support demand response, energy monitoring/service vendors. It would be great if they allow remote access/finetuning to setpoint and algorithms to optimize comfort and minimize energy/fuel use.
See this earlier work from my archives… http://ebrzez.wordpress.com/archives/
They have laid the foundation and can open a new world of residential energy services.
Ed
According to Micron’s FBGA magic decoder ring, the ROM is a 2Gb (WOW!), 16-bit NAND flash.
That’s 2 gigabits x 8 bits equals 256 megabytes.
Still a lot for a thermostat. Probably enough to log years of by-the-minute temperature, humidity, etc.
Let’s say one byte per value, which means 365 days x 24 hours x 60 minutes = 525600 bytes.
Let’s say one byte for temperature and one for humidity (no idea if that thing has a humidity sensor).
That 256 megabytes should be enough to log over 500 years of data.
or…. it is tracking ur every move and sending it wirelessly to their underground headquarters. They will get a report which tells them when and which room you are usually in….
The CC2591 is a 2.4GHz front end that can emit power up to 100mW (20dBm), then a few miles LOS ! The CC2530 is a 8bit SoC with a 8051 flavour processor, I bet that this device embeds the (relatively buggy) Z-Stack from TI that manage the ZigBee protocol, Home Automation and Smart Energy Profiles included. The device is reprogrammable via pin 20 (reset) and pins 34, 35 (2 wire debug interface) that are for sure connected to the ARM processor. I’m quite sure that this later embeds a Linux distro.
I get mine tomorrow, can’t wait!!
Really cool if they have Zigbee control in the future!!
Man I’d love one, but I feel like I gotta fix heat leaks and upgrade Heating/AC before spending $250 on a thermostat….
Sigh, now I want one too. I saw it in a magazine last week and thought ‘that’s really cool’, but now I just might have to get one… SparkFun group purchase? ;–)
Thanks for the teardown! I installed my nest a week and a half ago and have really enjoyed it so far. I was interested in the protocol, so I captured the network traffic at my gateway.
The nest does frequent dns lookups for something in XXXX.transport.nest.com, which currently maps to an amazon EC2 instance. Then it makes a TCP connection to port 9543 which it seems to hold open. This probably is so that when you go to the nest website it’s able to instantly communicate with your thermostat and not have to worry about your firewall. I think the traffic is encrypted, but it looked like a self signed SSL certificate. I didn’t dig any deeper at the time.
I wrote the support team and asked if there was an API I could use to get temperature graphs out of either their website or the device itself, and they said they did not yet have one. So my next course of action will be to see if there is any information I can glean from the protocol itself as it passes through my gateway and record/graph that. I just want a temperature graph of my house as measured by this thermostat, or a record of heater on/off in a format I can control.
The nest thermostat itself did not respond to any of my network mapping attempts.
I’ve been looking into this too. Looks like the best current solution for controlling the thermostat is to use the web interface. Here is a sample someone created to control it from siri. https://github.com/chilitechno/SiriProxy-NestLearningThermostat
however i would still like the ability to directly communicate to the device without having to go through their infrastructure.
from what i’ve been able to tell. nest communicates with the server over 9543. the web client communicates to the same server on port 9443. I would assume port 9543 is just HTTP traffic. The certificate is self signed. attempts at a man in the middle attack to decrypt the ssl packets haven’t worked for me so far.
If you attempt to goto https://XXXXXXXX.transport.nest.com:9543/ in your browser you’ll be presented with the same cert. after that you will be prompted with an authentication window. I haven’t tried using any of the api’s i’ve sniffed from the web client. however i suspect they are probably very similar.
I wish there was a good spot to share mor information about this more easily. any suggestions?
It’s the bare minimum shielding, backup battery power, & computing power the FBI requires for its spy gadgets. What did you think it was, a thermostat?
The Zigbee radio is used to connect with other Nests in the house when WiFi is not available.
@Ivan747: I recall learning that the zigbee service is dormant with the current version of firmware. Can you provide more info about your statement that it currently uses Zigbee to link multiple Nest hosts.
Thank you for this! I’d read some of the reviews leading up to the pre-order and liked everything I saw, but this tear down really drives home how awesome the device and the company behind it are. As soon as I can scrape together the $250, I’m going to have one of these on my wall.
My pleasure! It’s always fun to see the wizard behind the curtain.
Been in the hvac biz for 35 years. Just got one of these fancy gizmos and will give it a go around at my own home, looks very cool!! Funny it was designed by a computer geek and not an hvac engineer type.
Same for me. Gotta actually seal the house before investing too much in something like this.
Sorry. Did I missed what kind of sensor (thermistor, RTD, thermocouple or IC)is used by Nest to monitor room temperatures? The only sensor I read is the IC sensor used on the battery.
Good question – I don’t know actually. Tons of microcontrollers have temp sensors built in, the PIR could measure ambient, it could be anywhere on the board but money is that it’s IC based and not thermistor or other low-cost solution. Nest’s technology is pretty high end.
Also curious about how temp is measured. It is possible to do it with the PIR. Is that what they are doing? Or is there a thermistor in there somewhere?
Very cool! Did you notice who made the LCD?
I couldn’t quite get the LCD free. I felt like I would have had to break the plastic that frames the LCD to get to it.
One thing’s for sure: I had never seen a round LCD display before today.
edit: oh, optical illusion. Clever trick.
I would guess that the optical sensor on the wall side measures temperature. I don’t think the pid would be very accurate, and with a battery and so much processing inside, I can’t imagine the internal chip temps would be good either.
I think the third wire on the Lipo is Status. Funny because the battery in my broken iPod also has 3 wires.
Thanks for sharing this, it looks like such a great product.
Can you interact with this thing directly over WiFi, or does everything have to be done through their website? Something like sending UDP packets, or even a telnet-type command interface?? Would love to be able to query for temp/hum for logging purposes, and get notification of motion and integrate into home security. What about pushing messages to the LCD, and having them displayed?
As far as I can tell, none of that is possible. The support team did not tell me of an API, and the device itself does not appear to respond to ICMP or have any open/listening ports. It makes DNS requests and opens a TCP connection to their server, and that’s it so far.
Thanks for the info. Would be great if they decided to open up some APIs… I’d buy one in a second. This has some great potential for the hackers one way or another.
wow it’s awesome nate nice tutorial as ever.
The Zigbee is almost certainly for interfacing with smart meters so that they can do deals with utility companies and they may use it for additional temperature/motion/other sensors.
Given the wifi, they’re probably going to use it as a Zigbee gateway. There’s a LOT of potential to save copper when building a new house. No need for any wired light switches — just put a control unit in the fixture, and slap zigbee light switches wherever you want them.
Nice Teardown Nate! few thoughts on the pictures * It just might be a humidity sensor in the clear casing. Sure looks like there is a hole in it on the top%3F It could do temp as well. * the ‘important’ chips are probably bonded to make reverse engineering harder – if not impossible. you simply can’t access the connetions. Also%2C I would bet on 4-6 layer PCB. * my bet for the zigbee would be for home automation (IHC) systems. Look out for other sensors/controllers that the thermostat can connect to. Since the Nest has wifi, it could mayby function as a gateway for other sensors/meters. imagine a power meter that would display info on the same page as the thermostat
An awesome little device that sure has a great design! I love the dial-type input!
Argh! I have three thermostats; one for each floor of the house.
Thanks Nate, now I HAVE to get these.
The important question: Does it support real temperatures, or only Fahrenheit?
Yes it supports “real temperatures”. Try looking at the picture of the site.
What switches the HVAC circuits? FET or Triac?
Thermostats have three to six relays in them for switching the 24VAC circuits from the HVAC equipment. I don’t see any relays in the photo. So they must be using something solid state like a TRIAC to do the switching. What are they using?
The power switches are in your heater. Thermostats are 24V AC, low-power devices.
And I bet most heaters still use relays.
What kind of antenna they used? Whip , PCB or others antenna ?
Like to know about antenna too
Yeah! Thank you for saving me the time, Nest dudes :) I’ve had this project on my mind for a while. Guess i can check that one off the list./
I was on the Nest website and noticed that this device can operate in a house HVAC system that does not have a common ground (C or G wire.)
If this is the case, then how does the device power itself without using the 24VAC common ground line? I thought you need this to power thermostats without batteries.
I do see this has a LiPo battery, but I can’t image people are going to want to constantly charge the Nest thermostat.
I went to the Nest website and fill out their questionnaire to check whether or not the Nest is compatible with my 3 wire system (without Y or G common ground) and the website said Nest is totally compatible.
Any ideas how this puppy gets it’s source of power when the house does not have a common ground wire in the HVAC system?
Google on thermostat power stealing.
Apparently some HVAC systems don’t handle the way the Nest steals power very well: http://www.marco.org/2011/12/17/nest-incompatibility-without-c-wire
It seems to me the Nest would be better to use an ‘equalization cycle’ of the fan (R-G) to get it’s power. By running the fan for 5-10 minutes every so often would keep the batteries topped up and help keep the house temperature even throughout.
If you have multiple Nests co-located in a building, they communicate with one another to share learning & temperature information. I’d imagine that’s what the ZigBee is for.
I expect that the temperature sensor is the little board next to the PIR. Room air would convect up through the notch in the case.
Take another look at the RF connectors…they’re not actually u.fl, they’re switch jacks. In normal operation, the RF signal passes through them to the antennas, but when a coaxial probe is inserted into the socket it breaks the circuit and the RF energy is directed down the coax instead. It’s an and easy way to do RF test, a bit more expensive than a coaxial testpoint but the offsets are more consistent because the test gear isn’t in parallel with the antenna.
On the battery, the third wire is a temperature feedback line for charging. Many lithium chemistry chargers have provision for this, as an added safeguard in the event of cell failure.
Thank you Ward to point us in the RF test points from Murata.
Here you can find a good explantion how it works.
http://dkc1.digikey.com/es/en/tod/Murata/RFSwitchConnectors_NoAudio/RFSwitchConnectors_NoAudio.html
Yes, the horror – the sheer terror of it all. At last, our long national nightmare is over.
My theory on why the IC’s are bonded to the board — if they intend to sell this for use in commercial, industrial, or medical environments it may be that the standards specify additional shielding and hardening that is often found in industrial control systems.
What reason would they have to do this to prevent reverse engineering? It’s not exactly rocket science how this thing works; it’s just presumably really really excellent execution that makes this thing work well. In either case, the build quality is absolutely superb. I wish more devices were built to this sort of standard.
The underfill “bonded to the board” is for reliability. Lead free solder is brittle and the underfill distributes stresses across a larger area. This does not inhibit reverse engineering. It is easy enough to polish off the board and reball the chip for reverse engineering purposes.
This speaks to the build quality you referred to.
Not like the old days of 100mil 40pin DIP packages! But we would not have iPhones if we had to use old packaging technologies (instead we would call them iBricks).
The battery is needed because older thermostats were mechanical and not wired with a common wire. The only way to get power in this configuration is to turn on heat/ac or fan. Then current flows through the hvac’s relay to engage the system and I assume the nest charges the LiPo battery at the same time. When power is low I bet it runs your hvac fan for no other reason than to charge the battery. Also Honeywell has a patented method of “stealing” power but I’m guessing adding the battery was cheaper than dealing with a potential IP issue.
Great teardown of the Nest thermostat. For me, it just solidifies the breadth of potential the device has. I hope the company takes the Nest to the next level of home energy management. I’ve set up a Nest forum at http://nestthermostat.forumotion.com/so users can exchange ideas, thoughts and support.