US Home

(Last updated: Sunday April 17, 2011)

RCS TZ20 & TZ43

The TZB20 & TZB43 are prototype RCS thermostats. It looks like RCS never released them as products to the general public. These thermostats can be found cheaply on EBay for a relatively low price. With no documentation they're not really friendly to use but a little investigation and it appears that the engineers did a really good job of reuse. As closely as I can tell they use a similar protocol to the TR-16. This is my starting point.

RCS has a very good reputation for the products they make. So while I won't be able to get any support from RCS I expect that these will work for my rather odd needs (and a bit of hacker curiosity).

I found these on EBay when I was looking for Z-Wave thermostats. RCS also sells a TZ43, which is a Z-Wave model of the RCS thermostat. The TZB models may share the same hardware but the protocol is different (ZigBee != Z-Wave). The TZB20 is a RCS ZigBee prototype thermostat based on the RCS TR-16 thermostat and the Digi XBee wireless modules. Now understand that my home is electric base board heating and can't directly use standard 24v thermostats. Through the use of a contactor (24v controlled/220v) I can control the heaters.

So far I've found that the thermostat has an MSP430 processor (excellent low powered 16bit TI processor), an XBee Series 2 transceiver (XB24-Z7WIT-004) running the ZigBee stack (not the 802.15.4 stack or the ZNet 2.5 stack) and has the standard 24v interfaces to the HVAC. I'm trying to work out how to communicate with it. And for experimentation I intend to use a few LEDS and a 24Vac power supply (and maybe a fan). I have a Sparkfun XBee Explorer USB and when I get the rest of my TZB20s I'll steal an Xbee from it to see if I can figure how to communicate with these devices (done!). I must say I was confused by some of the terminology (coordinator, end-point, router, etc.). I found Robert Faludi's "Building Wireless Sensor Networks" and found it helped to clear that up as it covers these very chips.




On board, front:

XBEE Series 2

On board, back:

(C)2007 Digi Int'l 
PN:30009582-02 REV A

On sticker, back:

XB24-Z7WIT-004-revD1 (WIT = Whip Antenna, CIT = Chip Antenna)

Note that if you type in atdh (high) you should get back 0013A200. And if you type in atdl (low) 12345678 (0013A20012345678). This is the 64 bit serial number of the board.

ZigBee Info
Network: N/A Not Installed
MAC: 0013A200403ABB28
extPAN=Id: 0000000000000000
FW: 2341 HW: 1341
Chan: 00 RSSI: 0
Pan-Id: FFFF
New XBee boards

XBEE Series 2

STM-5 or TS-3
30009582-03 Rev A or 30009582-02 Rev A

XB24-Z7CIT-004-revF (and revG)

The 'XB24' is Xbee 2.4Ghz, normal power. 'XBP24' would be the PRO/higher power. 'Z7' means newer ZigBee 2007 stack, so look for the 'XB24-ZB' in XCTU pull-down. 'CIT' means it's a chip antenna.

[john@eccles ~]$ packet-check -api2
API Packet analyzer version 1.2 for XBees (802.15.4, DigiMesh, ZNet, ZB)
Escape characters enabled (AP=2)
Note: if it prompts for more bytes and you're done, hit return
Enter packet: 7E 00 1E 90 00 7D 33 A2 00 40 48 95 A3 23 3E 01 41 3D 30 30 20 4F 3D 31 20 5A 3D 31 20 54 3D 37 36 0D CA

Original packet: 7E 00 1E 90 00 7D 33 A2 00 40 48 95 A3 23 3E 01 41 3D 30 30 20 4F 3D 31 20 5A 3D 31 20 54 3D 37 36 0D CA

Unescaped packet: 7E 00 1E 90 00 13 A2 00 40 48 95 A3 23 3E 01 41 3D 30 30 20 4F 3D 31 20 5A 3D 31 20 54 3D 37 36 0D CA
7E // Correct packet header byte
00 1E // payload length (decimal 30)
90 // Packet type: ZigBee receive packet
   // Valid for DigiMesh, Znet2.5, ZigBee
00 13 A2 00 40 48 95 A3 // 64-bit source address
23 3E // 16-bit source address
01 // Rx options: ack
   // TX data (18 bytes) [1]
41 // transmitted data 'A'
3D // transmitted data '='
30 // transmitted data '0'
30 // transmitted data '0'
20 // transmitted data ' '
4F // transmitted data 'O'
3D // transmitted data '='
31 // transmitted data '1'
20 // transmitted data ' '
5A // transmitted data 'Z'
3D // transmitted data '='
31 // transmitted data '1'
20 // transmitted data ' '
54 // transmitted data 'T'
3D // transmitted data '='
37 // transmitted data '7'
36 // transmitted data '6'
0D // transmitted data CR
CA // checksum - correct

[1] Max 100 bytes on 802.15.4, or 72 on DigiMesh or ZNet2.5
[john@eccles ~]$ 
A=00 O=1 Z=1 T=76 <CR>

A typical TZB message sequence looks as follows:

From Host System address 00 : A=1 O=00 R=1 <CR> (originator O=00 is optional, A=1 R=1 <CR> is also valid) Which means message is being sent to device addressed 1, from Host address 00, requesting R1 status. The response to the above message from a network HVAC device with address = 1 would be:

A=00 O=1 Z=1 T=76 SP=78 M=H FM=0<CR>

Which means Reply to Host address 00, message originated from System address 1, Zone 1, Temp=76, Setpoint=78, Mode = Heat, Manual Fan = Off. For single zone devices


    Sent to Therm:   A=1 O=00 R=1 <CR>
    Recv from Therm: A=00 O=1 Z=1 T=76 SP=78 M=H FM=0<CR>


Okay the first thing I did was to make sure that my, PC connected, USB/XBee was running the coordinator software (I used the XCTU software to upgrade my USB/XBee). I have 2 XBees setup for this. One is an AT coordinator (you communicate using AT commands). The other is an API coordinator. At the moment I'm just using the AT coordinator. The TZB43 & TZB20s are setup as Router/End Devices and I haven't touched their XBee firmware yet.

The next thing I did was to connect to the USB/XBee with a terminal emulator (9600, 8, n, & 1). I did this because the XCTU software wouldn't permit me to cut and paste commands into the terminal window (very useful when you're experimenting). I next:

atid ffff

I typed in the white characters in my terminal emulator and the red characters are the response back from the USB/XBee. When you enter the '+++' do not hit enter and don't type anything for at least 2 seconds. Once you get the 'OK' you're ready to enter the appropriate AT commands. The session will timeout after 10 seconds and then the XBee falls back into transparent mode (anything you type is broadcast out to the network). The command 'atid ffff' set the PAN ID to FFFF (0000 0000 0000 FFFF). You can set it to anything you want but FFFF worked for me. Next I configured the TZB43.

TZB43 Setup

I found this on the SmartHome site. It's related to the EcoView system. It may not apply to the TZB43 but it does have a few things that are worth knowing (such as how to get into install mode).

  1. Once the thermostat has been installed, there will be four buttons across the bottom and up/down arrows next to screen.
    1. Press the Menu button to access the menu (this is the 1st button on the left).
    2. Hold the middle two buttons while on the first menu to access the installer menu.
    3. Scroll to System Settings using up/down arrows to the right of screen.
    4. Press Select.
    5. Arrow down to Mechanical Settings.
    6. Press Select.
    7. Enter package unit specifics here (number of stages, unit type, etc.) Refer to Appendix A - Thermostat Settings
    8. Press Done twice to get back to the main menu.
    9. Arrow down to Zigbee Install.
    10. Press Select.
    11. A prompt will be displayed asking to Add the thermostat to the network. Press the up arrow to accept only if the prompt displayed does not ask to Remove the thermostat from the network.
    12. Press Exit and Done to return to main menu
    13. Arrow down to Zigbee Network Info.
    14. Press Select.
    15. Ensure the Network says OPEN and the status says INSTALLED.
    16. Press Done to return to main screen.
  2. Thermostat Activation.
    1. Remove thermostat from back plate and wait 10 seconds.
    2. Reinstall thermostat to back plate. This will activate thermostat.
    3. NOTE: If this is not completed the thermostats may not communicate properly.

Once the TZB43 was 'OPENED' and 'INSTALLED'. I began typing commands on the USB/XBee and started getting responses back (yeah!).

TZB16 Setup

This comes from the RCS TR16 Manual, hopefully it will be similar to the TZB16.

Enter the setup mode by the following procedure:

  1. First press and hold the Mode button
  2. Simultaneously press the Fan button.
  3. The display will change to show "SU".
  4. Release all buttons.
  5. The display will change to show the setup menu, starting with "Ad" (address - this is the RCS address, not the XBee address)
  6. Select what setup function you want to change or view by pressing the Mode button to cycle through the menu options:
    • "Ad" Serial Network address
    • "FC" Fahrenheit or Celsius mode
    • "C1" Calibrate Internal Sensor (or Remote Sensor address 1 if attached)
    • and if additional external sensors are attached they will appear also:
      "C2" (if Remote Sensor address 2 attached)

What I saw in the terminal emulator

A=00 O=1 Z=1 T=78 (automatically, maybe every 60 seconds this occurs)

A=1 O=00 R=1
A=00 O=1 Z=1 T=78 SPH=62 SPC=82 M=H FM=0

A=1 O=00 R=2 (Type 2 Query)
A=00 O=1 H1A=0 H2A=0 H3A=0 C1A=0 C2A=0 FA=0 SCP=00

A=1 O=00 R=6 (Type 6 Query)
Rx: A=00 O=1 TZB43=V02.00.20/TZB43=V-2.00.20

I typed in (okay, I edited the commands in an editor and pasted in) the strings in white. The cyan text is just comments and the red text is what is being sent from the thermostat. The white is what I typed in.

XBee 1mW Chip Antenna (XB24-ACI-001) - 802.15.4 OEM RF modules (S1 ?)
XBee ZB ZigBee (XB24-Z7CIT-004) - ZigBee (S2B?)

RCS chips   - 2241 XB24-B (AT  Router/End Device Sensor Adapter)
RCS chips   - 2341 XB24-B (API Router/End Device Sensor Adapter, Hmmm>/i>)
EBay chips  - 2270 XB24-B (AT  Router/End Device Digital IO Adapter)
Mark 0 Chip - 2064 XB24-B (AT  Coordinator, AT Command Mode (AP=0), were EBay chips)
Mark 1 Chip - 2164 XB24-B (API Coordinator, API Mode (AP=1,2), were EBay chips)

TZB43 - 0013A200 403ABB28
        XB24-Z7WIT-003 revA
USB   - 0013A200 4064EFF3


Then use the Setup instructions above to install the ZigBee network on the TZB43

Rx: A=00 O=1 Z=1 T=78 (automatically, about every 60 seconds this occurs)

Tx: A=1 O=00 R=1 (Type 1 Query - Note: Don't send the <CR>)
Rx: A=00 O=1 Z=1 T=78 SPH=62 SPC=82 M=H FM=0

Tx: A=1 O=00 R=2 (Type 2 Query)
Rx: A=00 O=1 H1A=0 H2A=0 H3A=0 C1A=0 C2A=0 FA=0 SCP=00

  - HEATING STAGE 1 Status. Format: H1A=x, where x = 0 for Off or 1 for On
  - HEATING STAGE 2 Status. Format: H2A=x, where x = 0 for Off or 1 for On.
  - COOLING STAGE 1 Status. Format: C1A=x, where x = 0 for Off or 1 for On.
  - For Ver 2.9 (2 stage systems only)
    COOLING STAGE 2 Status. Format: C2A=x, where x = 0 for Off or 1 for On.
  - FAN Relay Status. Format: FA =x, where x = 0 for Off or 1 for On.
  - SCP/MRT Status. Format: SCP =x, where x=0 for Off or 1 for On. Status
    is on whenever the Short Cycle Protection (SCP) Delay on Compressor Call
    is active or Minimum Run Time (MRT) delay off is active. (Ver 2.9)

Tx: A=1 O=00 R=6 (Type 6 Query)
Rx: A=00 O=1 TZB43=V02.00.20/TZB43=V-2.00.20

Okay, now we have it working!

** XBee-ZB Firmware Versions **

XBee version numbers will have 4 significant digits. A version number is reported by issuing an ATVR command. The response returns 3 or 4 numbers. All numbers are hexadecimal and can have a range from 0-0xF. A version is reported as "ABCD". Digits ABC are the main release number and D is the revision number from the main release. "B" is a variant designator. The following variants exist in ZB firmware:

  • "0" - Coordinator, AT Command Mode (AP=0)
  • "1" - Coordinator, API Mode (AP=1,2)
  • "2" - Router AT Command Mode (AP=0)
  • "3" - Router API Mode (AP=1,2)
  • "8" - End Device, AT Command Mode (AP=0)
  • "9" - End Device, API Mode (AP=1,2)

Digi has developed an assortment of sensor adapter products that use the ZB firmware. (See for details.) Adapter firmware versions include the following variants:

  • "4" - Router/End Device Sensor Adapter
  • "5" - End Device Power Harvester Adapter
  • "6" - Router/End Device Analog IO Adapter
  • "7" - Router/End Device Digital IO Adapter

All releases will have an even number for C. All internal development will have an odd number for C. Field D is always present, even when D is 0.


  • The RCS TZB20 appears to be similar to the TR16
  • The RCS TZB43 appears to be similar to the TR40
  • Instead of RS485 (used in the TR16 & TR40) the XBees are used.
  • XBees can be purchased with or without ZigBee (Series 1 without? Series 2 with? - XB24-B, series 2)
  • ZigBee networks always have a single coordinator device (I now have an API & ATI Coordinator setup).
  • ZigBee networks also have, at least, either one router or end-device
  • Routers are always on device and are plugged into a constant power source (such as a power outlet).
  • End-devices can save power by going into non-responsive sleep mode.
  • Routers can also contain end-device (minus the sleep mode).
  • ZigBee uses source-routing
  • To configure the XBees you'll need X-CTU
  • There is the AT mode (like the Hayes AT command set) and the API mode (which one for the TZB? Probably AT)
  • ZNet2.5? ZigBee? Probably ZigBee (ATVR -> 2241 response)