Before telling the story, I need to say who did it, or none of it will make sense.
I'm a senior software engineer. I can design systems, read a spec, debug ugly problems. About hardware I knew close to nothing. The only program I had ever written for an ESP32 was a loop that blinked some LEDs to a beat: a digitalWrite() inside a delay(), and the satisfaction of someone who has just invented fire.
I had never soldered anything that mattered, never used a multimeter with any real understanding, and the basics of electronics — logic levels, what happens if you feed a module 5V instead of 3.3V, what a differential line even is — I knew only vaguely, the way you know a subject you've never actually had to deal with.
What I do have is the DIY habit. And there is a very specific satisfaction that people who only write software never fully get to feel: the code you write every day lives inside a screen, and when it works, a green test tells you so. Nice, but abstract.
When instead the code you wrote runs through a wire you stripped yourself, into a connector you soldered yourself, and on the other end a physical thing moves — a fancoil spins up, a display changes a number, a valve opens — the satisfaction is an order of magnitude bigger. It stops being a program. It becomes an object that does something in the world, and it does it because you put it there.
And if that object then solves a real, everyday annoyance instead of being a demo you push to GitHub and forget, that's about as good as it gets. It's the only real reason anyone spends fifteen evenings on a thermostat instead of watching a show.
That said: without AI, this project would not have happened. Not "it would have taken longer" — it would not have happened. I would have stopped at the first six-pin RS-485 module, with nobody to ask whether the bus GND needs to be tied in or not.
The rest of this article is the story of where what I already knew ends, and where what I learned along the way begins.
There is a Delta Controls eZNT-T331 on my living room wall. It manages three zones and drives the fancoils: cooling in summer, heating in winter. It's done its job reliably for years, without a single hiccup.
What it does have is a serial bus, on which it chats with the system's central control unit twenty-four hours a day.
It talked to everyone except me. And since the rest of my home is already automated, having to get up and walk to the wall to change a setpoint had become genuinely annoying — the kind of friction that irritates you a little more every single time.
Swap it for a smart thermostat? Not a workable path. This isn't a standalone appliance: it's part of a centralized HVAC system and talks to a controller that manages several zones together. Replacing it means reworking the interface with that system, involving whoever manages it, paying an integrator, and ending up with yet another closed device anyway.
The only sensible route was the opposite one: leave the thermostat exactly where it is, and learn to speak its language.
Starting inventory: One wall thermostat. Its user manual. The end-user one: buttons, menus, "press here to set holiday mode." No datasheet, no protocol spec, no integrator documentation, no credentials.
I started by reading the device. Menu by menu, screen by screen: which values it shows, which it lets me change, which change on their own.
Then the discovery that cracked the whole thing open: there's an installer menu, password-protected. Protected by the default password, naturally. (Thank you, installers of the world. Never change.)
Inside that menu was an entry that makes no sense on a standalone appliance: the ability to change the device's MAC address. An address. On a tiny scale, something like "21." Not an Ethernet MAC — a node address on a bus.
I went and looked up the model's technical specs online, and the picture completed itself: the eZNT-T331 exists in two variants, one BACnet/IP and one BACnet MS/TP. The IP variant needs an Ethernet connection, and there's none in my wall. MS/TP runs over RS-485 and identifies nodes with exactly the kind of small address I'd just seen in the menu.