How a Smart Thermostat Is Made: Sensors, Relays, Wi-Fi and Firmware

A smart thermostat is made by putting a temperature and humidity sensor, often an occupancy sensor, a small display and a wireless system on a chip onto one printed circuit board, then adding relays or solid state switches that open and close the low voltage control wires of a heating and cooling system. Firmware on that chip runs the control loop, learns a schedule, talks to a vendor cloud or to a Matter controller over Wi-Fi or Thread, and installs signed updates. Along the way it records run times, set points and occupancy, which is why the energy data matters as much as the hardware.

This post goes one level deeper than our builds of a smart lock, a smart electricity meter and a smart speaker. Those posts cover secure elements, metrology and microphones. This one is about the device that decides when your furnace, air conditioner or heat pump runs.

Electrical safety first. Most central HVAC thermostats in North America switch a 24 volt AC control circuit, but some heating systems use line voltage thermostats wired directly to 120 or 240 volt mains, and the furnace or air handler that the thermostat wires lead back to always contains mains voltage. Do not open, rewire or replace a thermostat or any HVAC equipment unless the power is switched off at the breaker and you have confirmed it is off, and get a qualified HVAC technician or electrician for anything you are not certain about. Nothing in this post is a wiring guide for your specific system.

Key takeaways

• A smart thermostat is four subsystems on one board: sensing (temperature, humidity, occupancy), switching (relays or triacs on the R, C, W, Y, G and O/B wires), power (a C wire or "power stealing" from the HVAC circuit, plus a small battery or supercapacitor) and connectivity (a Wi-Fi system on a chip, sometimes with a Thread or Bluetooth radio).
• The hardest physical problem is power. Without a common (C) wire there is no return path for steady 24 VAC power, so many designs borrow tiny currents through the equipment's own control wires. Google's Nest help pages say some systems, including heat pump and zone controlled systems, need a C wire or a power accessory.
• The firmware is a control loop with hysteresis, minimum run and off times, staging logic and a learning schedule, plus an over the air update path. A secure update path verifies a signed manifest, refuses older images and keeps a known good copy to fall back to, as described by the IETF in RFC 9019.
• ENERGY STAR's current smart (connected) thermostat specification is Version 1.0, effective 1 January 2017. It requires the thermostat to keep working locally without the cloud, to meet a static accuracy of plus or minus 2.0 degrees Fahrenheit and a network standby average of 3.0 watts or less, to support utility demand response with consumer override, and to be capable of collecting specific data such as ZIP code and hourly set points.
• The FCC's US Cyber Trust Mark rules were adopted in March 2024. As of the FCC's own page in October 2026, the program has a new lead administrator (effective 13 April 2026) and recognised accreditation bodies (28 September 2026), but the FCC has not yet announced that products can apply to carry the label.
• Matter runs over Wi-Fi and Thread and uses Bluetooth Low Energy for commissioning, according to the Connectivity Standards Alliance. Its biggest change for thermostats is local control by more than one ecosystem at once (multi-admin) without each one needing the vendor cloud.
• End of support is real. Google ended app and cloud support for the first and second generation Nest Learning Thermostats on 25 October 2025, and those devices no longer receive software or security updates.

Raw material to installed thermostat: the step table

The table below follows a typical Wi-Fi smart thermostat from parts to a working installation. Factories differ, so treat it as the common pattern rather than any one company's line.

Steps 7 and 8 are where much of the security and accuracy is decided, and they happen in the factory, long before anyone opens an app.

What is inside a smart thermostat?

Open the back of a smart thermostat (with the power off) and you see a wall plate with screw or push terminals labeled with letters, and a head unit that clips onto it. Most of the electronics sit in the head unit.

Temperature and humidity sensors

The core sensor is a digital temperature sensor, often combined with a relative humidity sensor in one small package that talks to the main chip over I2C. The engineering challenge is not the sensor itself but where it sits. Every chip on the board makes heat: the Wi-Fi radio when it transmits, the voltage regulator, the display backlight. A sensor placed a few millimetres from those parts reads the board, not the room.

Designers handle this in three ways. They isolate the sensor physically, sometimes on a small tab of PCB joined to the main board by a thin neck, with slots cut in the board to stop heat flowing through the copper. They place vents so room air passes over the sensor. And they compensate in firmware, using a model that estimates self heating from the display brightness, radio activity and processor load and subtracts it.

ENERGY STAR sets the bar for how well this has to work. Its connected thermostat specification requires a static temperature accuracy of plus or minus 2.0 degrees Fahrenheit, measured as the deviation of the displayed or communicated temperature from 70 degrees Fahrenheit (21 degrees Celsius) after an hour in a calibrated environment. The specification notes the definition is based on a NEMA standard for programmable thermostats.

Many smart thermostats also accept remote room sensors over a low power radio, so the control loop can average several rooms or follow the room that is occupied. Those sensors add more radio links and more battery powered devices to keep updated.

Occupancy and proximity sensors

Occupancy detection usually comes from a passive infrared (PIR) motion sensor behind a small lens in the front of the unit, sometimes supported by a near field proximity sensor that wakes the display as you approach. Some products add ambient light sensing to dim the screen. A thermostat can also infer occupancy from phones, using geofencing, which ENERGY STAR describes as letting the thermostat know when you have left or are on the way home.

From a privacy point of view, occupancy is the most sensitive thing a thermostat measures. A log of when the hallway sees motion is a log of when people are home.

The display and input

Displays range from segment LCDs to full color round TFT panels with a rotating ring or a touch surface. The display is one of the largest power consumers, which matters because, as we will see, a thermostat often has very little power to work with. ENERGY STAR requires a certified unit to drop into network standby within 5.0 minutes of the last user interaction, whether that interaction was on the device, remote or an occupancy detection, and to average 3.0 watts or less in that state.

The wireless system on a chip

The brain is usually a wireless microcontroller or system on a chip (SoC) that combines a processor core, flash and RAM, a Wi-Fi radio and often Bluetooth Low Energy. Bluetooth is commonly used during setup to pass Wi-Fi credentials from a phone. Thermostats that support Thread add an IEEE 802.15.4 radio, either on the same chip or as a separate one. The Thread Group describes Thread as an open IPv6 based mesh protocol built on the IEEE 802.15.4 MAC and PHY, designed for low power devices.

Some designs split the job across two chips: a Wi-Fi or Thread chip that handles networking, and a separate microcontroller that runs the HVAC control logic and drives the relays. The split has a safety benefit. The HVAC controller can keep heating the house according to its last schedule even if the networking chip crashes or is in the middle of an update.

Relays, triacs and the switching stage

Each HVAC function (heat, cool, fan, reversing valve, second stage, auxiliary heat) needs a switch that connects the R (24 VAC hot) wire to that function's wire. Two families of switch are common:

• Electromechanical relays. A coil moves a contact. Latching relays are popular in thermostats because they need a short pulse to change state and no power to hold it, which helps the power budget. They give true galvanic isolation and a clean on or off, with an audible click.
• Solid state switches (triacs or MOSFET based solid state relays). No moving parts and no click, and they allow techniques such as switching at the zero crossing of the AC waveform. A triac leaks a small current when off, which is useful for power stealing but can upset some equipment.

Around the switches sit protection parts: fuses or polyfuses, transient voltage suppressors to absorb spikes when a contactor coil is released, and circuits that detect which wires are actually connected. Many smart thermostats sense whether a terminal has a wire in it, which is how the app can warn you that a wire is missing or in the wrong place.

Power: the C wire problem and power stealing

An old mechanical thermostat needed no power. It was a bimetal strip and a mercury switch or a set of contacts. A smart thermostat needs a steady few hundred milliwatts on average, with bursts of much more when the Wi-Fi radio transmits or the display lights up.

The HVAC control circuit is powered by a step down transformer in the furnace or air handler, which supplies 24 VAC between the R wire and the C (common) wire. If a C wire runs to the thermostat, powering it is easy: connect across R and C. Many older homes, though, have only R, W, Y and G at the wall, because the old thermostat never needed C.

Google's Nest help center puts it plainly: unlike the other wires, a C wire does not control heating or cooling and only provides constant power to the thermostat. It says Nest thermostats are designed to use very little power and in many cases can draw enough from the heating and cooling wires, but that some systems, including heating only, cooling only, zone controlled and heat pump systems, require a C wire or a compatible power accessory. Symptoms it lists for insufficient power include reduced battery life and a low power error during the app's power test.

That technique of drawing power from the heating and cooling wires is usually called power stealing or power sharing. It works in two ways, and real designs often use both:

1. While a function is off, the thermostat lets a very small current flow from R through, for example, the W wire and the gas valve or relay coil it controls, back to the transformer. The current is chosen to be well below what would pull in the coil, so the equipment stays off while the thermostat trickle charges a battery or supercapacitor.
2. While a function is on, the R to W path is a closed switch with almost no voltage across it, so there is nothing to harvest. The thermostat can briefly open the switch for a fraction of a cycle to harvest a little energy, short enough that the coil does not drop out.

Both are compromises. Some modern control boards, especially electronic ones in high efficiency furnaces and heat pumps, read the tiny off state current as a call for heat or a fault, which can cause the system to turn on unexpectedly, chatter or short cycle. That is why vendors offer a power adapter accessory that sits at the equipment end and creates a powered path without running a new wire, and why the honest fix for many systems is to have a technician run or repurpose a conductor as a C wire.

Worked example 1: a power stealing budget (illustrative)

These numbers are illustrative, chosen to show the trade off, not taken from any one product.

Assume the thermostat averages 0.25 W (250 mW) over a day once the display has dimmed and the radio sleeps most of the time, with bursts during Wi-Fi activity. The control circuit is 24 VAC.

• Average current needed at 24 V: 0.25 W divided by 24 V is about 10.4 mA.
• Suppose the coil it steals through would start to pull in at around 30 to 40 mA on a sensitive electronic board. A 10 mA trickle leaves only a modest margin, and conversion losses in the thermostat's power supply (say 70 percent efficient) push the real draw toward 15 mA.
• Now the Wi-Fi radio wakes and transmits at roughly 1 W for 2 seconds every minute. That burst alone averages 1 W times 2 s divided by 60 s, about 33 mW, which is fine on average but far above what can be stolen instantaneously. The battery or supercapacitor has to supply the peak, and the stolen trickle has to refill it.

The lesson: power stealing works when the average power is small and the storage element covers peaks. It breaks down when the display is bright for long periods, the Wi-Fi link is weak (more retries, longer transmissions) or the equipment is sensitive to leakage. A weak Wi-Fi signal is a power problem as well as a connectivity one, which is one reason ENERGY STAR's buying tips say to keep the thermostat reasonably close to the router.

How do the HVAC control wires work?

The colors on your wires are conventions, not rules, and installers do not always follow them. The letters on the terminals are what matter. The table below describes the common North American low voltage terminals. Again: if you are not sure what a wire does in your home, stop and ask a qualified technician.

How a heat call works, end to end

When the thermostat decides the room is too cold, it closes the switch between R and W. Current flows from the transformer's 24 VAC winding, through R, through the thermostat's switch, down the W wire to the furnace control board, which then sequences the inducer fan, ignition, gas valve and blower. The thermostat never switches mains power on a central system like this; it sends a low voltage signal and the equipment's own controls switch the high power loads.

Heat pumps and multi stage systems

Heat pumps add two complications. First, the compressor (Y) runs in both modes, and the reversing valve (O or B) decides whether heat moves into or out of the house. A thermostat configured with the wrong reversing valve setting will heat when asked to cool. Second, heat pumps usually have auxiliary heat (often electric resistance strips) that should run only when the heat pump cannot keep up, because resistance heat costs much more to run. Good firmware stages auxiliary heat carefully: it waits, checks whether the room temperature is still falling behind, and may use an outdoor temperature lockout.

ENERGY STAR cares about exactly this. Its savings criteria include a reporting requirement for average resistance heat utilization on heat pump installations, broken into 5 degree Fahrenheit outdoor temperature bins from 0 to 60 degrees Fahrenheit. The specification also requires the product to be capable of collecting hourly auxiliary and emergency heat run times to the nearest minute.

Line voltage thermostats

Electric baseboard heaters and some radiant systems use line voltage thermostats that switch 120 or 240 volt mains directly. These are a different product category with very different hazards. ENERGY STAR's connected thermostat specification explicitly excludes line voltage thermostats. If your heaters are wired this way, a standard low voltage smart thermostat is not compatible, and the wiring is a job for an electrician.

How does the board switch these wires safely?

Safe switching on a thermostat board comes down to a few design rules:

• Interlocks in hardware and firmware. The firmware should never energize conflicting outputs, such as heat and cool together, and some designs add hardware interlocks so a software fault cannot do it either.
• Default states. At power up and during a firmware update, every output should start open (off), and the controller should only close a switch after it has a valid configuration.
• Short cycle protection. Compressors are damaged by rapid on and off cycling. Firmware enforces a minimum off time before a compressor can restart and often a minimum run time. Equipment manufacturers specify these values, and many outdoor units also enforce their own delay.
• Isolation and spacing. Even on a 24 VAC circuit, transformer faults and miswiring happen. Boards use fuses, transient suppressors and adequate spacing so a wiring error blows a fuse rather than starting a fire.
• Wire detection. Sensing which terminals have wires lets the firmware refuse an impossible configuration, such as a heat pump setup with no Y wire.

How is the board made and assembled?

The manufacturing sequence follows the step table above: paste print, pick and place, reflow, optical inspection, then a test fixture that checks every unit's rails, relays, sensor and radio. A few details are specific to thermostats.

PCB layout for honest temperature readings

The board is typically a four layer FR-4 design. The radio and its antenna need a clean ground and a keep out area. The relay section needs spacing and wide traces. And the temperature sensor needs to be thermally isolated. Engineers model heat flow and then verify it in a chamber, measuring how far the reading drifts when the display is at full brightness and the radio is transmitting continuously. That drift is the input to the self heating compensation in firmware.

Provisioning identity and keys

This is the security heart of manufacturing. The production station writes the signed production firmware, a unique serial number and a device identity. Depending on the design, it may generate a key pair on the device so the private key never leaves the chip, then have the factory's certificate authority sign a device certificate. Products that will be Matter certified also need the attestation material that a Matter controller checks during commissioning, plus a setup code printed as a QR code and digits on the label or packaging.

NIST's IoT Device Cybersecurity Capability Core Baseline, NISTIR 8259A (May 2020), names device identification as one of its baseline capabilities alongside device configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness. Factory provisioning is where device identification is made real. If every unit shipped with the same key, or with a key the factory kept a copy of in a spreadsheet, nothing later in the life of the product would fix it.

Debug ports and production lockdown

Development boards expose debug interfaces so engineers can load code and inspect memory. Production units should have those interfaces disabled or locked once provisioning is complete, flash read out protection turned on where the chip supports it, and secure boot enabled so only signed images run. These are standard steps in any responsible IoT production line and they map onto the NISTIR 8259A capabilities for logical access to interfaces and software update. We do not go further into how such protections are tested from the outside; the point for owners is that a well made product has them on from the factory.

How does the firmware work?

A thermostat's firmware has two very different jobs: keep the house comfortable safely, and keep itself up to date and connected. Good designs keep the first job working even when the second one fails.

The control loop and hysteresis

The simplest thermostat control is on and off with hysteresis. In heating mode with a set point of 20 degrees Celsius and a hysteresis (also called a differential or deadband) of 0.5 degrees, the firmware turns heat on when the room falls to 19.5 and off when it reaches 20.5, or variations on that pattern. Without hysteresis, the system would switch on and off every time the reading flickered across 20.0, wearing out equipment and wasting energy.

Smart thermostats layer more logic on top:

• Minimum on and off times to protect compressors and reduce cycling losses.
• Cycle rate limits expressed as maximum cycles per hour, which vary by equipment type (a hot water radiator system behaves very differently from a forced air furnace).
• Predictive start that begins heating early so the room reaches the set point at the scheduled time, using a learned estimate of how fast this house heats up.
• Staging that runs first stage, then second stage or auxiliary heat only when the first stage cannot keep up within a time limit.
• Dual set point (auto) mode that keeps a minimum gap between heating and cooling set points so the system does not fight itself.

Worked example 2: hysteresis and cycle length (illustrative)

Suppose a house loses heat so that, with the furnace off, the room cools at 1.5 degrees Celsius per hour, and with the furnace on it warms at 3.0 degrees Celsius per hour. The thermostat holds 20 degrees with a total swing (deadband) of 1.0 degree, from 19.5 to 20.5.

• Heating phase: 1.0 degree at 3.0 degrees per hour takes 20 minutes.
• Coasting phase: 1.0 degree at 1.5 degrees per hour takes 40 minutes.
• One full cycle is 60 minutes, so about one cycle per hour.

Halve the deadband to 0.5 degree and both phases halve: 10 minutes on, 20 minutes off, two cycles per hour. Comfort improves slightly because the swing is smaller, but the equipment starts twice as often. A minimum on time of, say, 5 minutes would not bind here, but on a mild day when the furnace warms the room in 3 minutes, it would, and the room would overshoot slightly instead of the furnace short cycling. These are the trade offs firmware tuning is about.

Learning schedules and occupancy

A learning thermostat watches when people change the set point and when occupancy is detected, and builds a weekly schedule from those patterns. It may combine that with phone geofencing to set back temperatures when everyone has left. ENERGY STAR's product page describes both features in general terms and notes that over the air updates let a certified thermostat use the latest algorithms.

From a data perspective, learning means a stored history of manual changes and occupancy events, on the device or in the cloud depending on the design.

Worked example 3: what ENERGY STAR's savings thresholds mean (illustrative)

ENERGY STAR certifies smart thermostats on field data rather than lab tests alone. Service providers run EPA provided software over a year of data from hundreds of customers' homes. To qualify, the lower 95 percent confidence limit of the weighted national average reduction in heating run time must be at least 8 percent, and in cooling run time at least 10 percent. The weighted national average of the 20th percentiles must be at least 4 percent for heating and 5 percent for cooling.

Take a home whose furnace runs 1,200 hours a heating season with a basic thermostat at a constant set point. An 8 percent run time reduction is 96 fewer hours. If the furnace burns gas at 80,000 Btu per hour of input when running, that is 96 times 80,000, or 7.68 million Btu, about 77 therms saved. For cooling, a 10 percent cut on 800 compressor hours is 80 hours; at an average 3.5 kW draw that is 280 kWh. Your house will differ; the point is that the criteria are expressed as run time reductions, which is also why the thermostat has to log run time to the nearest minute.

Over the air updates

ENERGY STAR's specification defines the connected thermostat product as the device with associated firmware "assumed to be updated" during its time in the home, together with the cloud service. It also requires that the product keep its required capabilities through later firmware and software changes. Updates are part of the definition, not an optional extra.

A typical update flow:

1. The thermostat checks in with the vendor's update service on a schedule or when told to by a push message.
2. If a newer image is available for its hardware model and current version, it downloads the image over an authenticated, encrypted connection, usually in the background.
3. It writes the image to an inactive partition (an A/B layout), so the running copy is untouched.
4. The bootloader or update agent verifies the image's signature and metadata before marking it bootable.
5. The device reboots into the new image at a quiet moment, ideally when the HVAC is idle, with every output held off during the restart.
6. The new image runs self checks. If they pass, it is marked good. If they fail, or the device does not check in within a set time, the bootloader rolls back to the previous image.

What does a secure update path look like?

The IETF wrote down the architecture for this in RFC 9019, "A Firmware Update Architecture for Internet of Things" (April 2021), and RFC 9124, the information model for the manifest (January 2022). The central idea is a manifest: a signed piece of metadata that travels with the firmware and tells the device what the image is, which devices it is for, its version or sequence number, and a digest of the image contents. The device trusts the manifest because it is signed by a key it already trusts, and it trusts the image because the digest matches.

Translated into thermostat terms, a secure update path has these properties:

Note the difference between authenticity of the transport and authenticity of the firmware. A connection secured with TLS proves the device talked to the right server. Only the signature over the manifest proves the image came from the vendor's release process. If the update server were ever compromised, the signature check is what stops a malicious image.

The last row matters to owners as much as the cryptography. ETSI EN 303 645, the European consumer IoT security standard (the V3.1.3 file on ETSI's server is dated September 2024), and NIST's consumer profile NISTIR 8425 (September 2022) both treat software updates and information about support as baseline expectations for consumer devices.

How do smart thermostats connect?

There are three broad connection models today.

Wi-Fi to a vendor cloud

The most common pattern: the thermostat joins your Wi-Fi, opens an outbound, encrypted connection to the vendor's cloud and keeps it alive. The phone app talks to the cloud, not directly to the thermostat. The cloud stores schedules and history, runs some of the learning, delivers updates and relays commands from voice assistants and utility programs.

The upside is simple setup and remote control from anywhere. The downside is that remote control, integrations and sometimes the schedule editor depend on the cloud being reachable and the vendor continuing to run it. ENERGY STAR addresses the worst case: a certified device must, without connectivity to the service provider, still let residents view the room temperature, view and adjust the set temperature, and switch between off, heating and cooling locally.

Matter over Thread or Wi-Fi

Matter is a connectivity standard from the Connectivity Standards Alliance (CSA). The CSA describes it as a unifying, IP based protocol whose first specification runs on Wi-Fi and Thread network layers and uses Bluetooth Low Energy for commissioning. Thermostats are one of the device types Matter defines.

What Matter changes for a thermostat:

• Pairing. You scan the setup QR code or enter the code on the label with any Matter controller app. The controller checks the device's attestation, provisions network credentials (Wi-Fi details, or Thread network credentials through a border router) and issues the device an operational identity for your home's fabric.
• Local control. Commands travel over your local network using IPv6. A Matter controller in the home can change the set point without going through the thermostat maker's cloud.
• Multi-admin. The CSA highlights that devices from multiple brands work together natively and that one device can be controlled by more than one ecosystem. A thermostat can be added to two different smart home platforms at the same time.
• Thread. On Thread, the thermostat is part of a low power IPv6 mesh. It reaches the rest of the network through a Thread border router, which is often built into a smart speaker, hub or router.

What Matter does not change: the thermostat maker's firmware still runs the control loop, the vendor still ships firmware updates, and many products still offer a vendor cloud for features such as energy reports and learning. Matter adds a standard local interface; it does not by itself remove the cloud.

Local APIs

Some thermostats offer a documented local API over the home network, and many offer a cloud API for third party integrations. ENERGY STAR requires an interface specification or API that at a minimum enables demand response functionality, though its specification lets providers limit access to qualified developers and partners. It also says products enabling direct, on premises, open standards based interconnection are preferred.

Comparison: programmable, cloud smart and Matter local thermostats

What data does a thermostat collect, and who receives it?

What the device can collect

ENERGY STAR's specification is unusually specific. To be certified, the product must be capable of collecting:

• a unique thermostat ID,
• the ZIP code of the installed location,
• the controlled HVAC equipment type, as far as it can be determined,
• daily cooling and heating equipment run time, to the nearest minute,
• hourly auxiliary heat and emergency heat run time, to the nearest minute,
• hourly average indoor temperature, to the nearest 0.5 degree Fahrenheit,
• hourly average heating and cooling set points, to the nearest 1.0 degree Fahrenheit.

That list exists so the service provider can compute the field savings metrics. On top of it, a typical cloud smart thermostat may handle humidity, occupancy events, geofencing results tied to your phone, your account details, your Wi-Fi network name, weather for your location and the times and sources of every set point change.

Put together, that is a detailed picture of a household: when people wake, leave, come back and go to bed; when the house is empty for a week; how big and how efficient the home is.

What one vendor says about its data

Claims about how a company handles data should come from the company itself. Google's privacy commitments for its connected home devices, published on its Safety Center, say that when a connected home device includes environmental or activity sensors, the hardware features are listed in the device's technical specifications whether or not they are enabled, and that Google explains what these sensors send in a Sensors Guide. They say Google keeps home environment sensor readings, video and audio recordings separate from advertising and does not use that data for ad personalization. They also say Google provides automatic critical security updates for Google Nest devices for at least 5 years from the date it starts selling them, and that Google's general Privacy Policy also applies.

That last commitment is worth reading carefully: it is measured from the start of sales, not from the date you bought the unit. For other vendors, read the privacy policy and support policy for the specific product; do not assume they match.

Utilities and demand response

Demand response (DR) is how utilities and grid operators ask homes to use less power at peak times. A thermostat in a DR program receives an event, typically on a hot afternoon, and pre cools the house or raises the cooling set point by a few degrees for a couple of hours. In return the customer receives a bill credit or rebate.

ENERGY STAR builds DR into certification. The product must provide a communication link using open standards for demand response, an interface specification or API that enables DR, and, importantly for owners, "consumers shall be able to override" the product's response to any DR signal. ENERGY STAR's product page says certified smart thermostats are designed to be compatible with utility programs that help manage reliability while preserving the owner's ability to override grid requests.

One of the open standards in this space is OpenADR. The OpenADR Alliance describes it as a two way information exchange model and smart grid standard that standardizes messages for automated demand response and distributed energy resource management, and says the IEC approved the OpenADR 2.0 profile specification as IEC 62746-10-1 in 2018. In practice, many thermostat DR programs run cloud to cloud: the utility's demand response management system talks to the thermostat maker's cloud, which then commands enrolled thermostats.

DR enrolment means data flows to the utility or its program operator. Typically that includes whether you participated, whether you overrode an event and run time around the event, so that savings can be verified. The exact data depends on the program terms, which you agree to when you enrol.

How can a user limit it?

Turn off features you do not use (geofencing, third party integrations), remove old accounts and integrations, protect the vendor account with two factor authentication, and read any utility program terms before enrolling. Steps 5 and 6 of the walkthrough below cover where to find these settings.

What do ENERGY STAR and the US Cyber Trust Mark require?

ENERGY STAR smart thermostats: Version 1.0

ENERGY STAR's product page lists the current specification effective date as 1 January 2017, and the published program requirements and eligibility criteria are titled Version 1.0 for Connected Thermostat Products (revised January 2017). The key product criteria are:

ENERGY STAR is an energy efficiency program. It does not set cybersecurity requirements for thermostats.

The US Cyber Trust Mark

The US Cyber Trust Mark is the FCC's voluntary cybersecurity labeling program for wireless consumer IoT products. According to the FCC's program page:

• the program is based largely on criteria established by NIST, and applies to wireless consumer IoT products, with exclusions such as wired devices, medical devices and products from entities on national security lists;
• a label will carry a QR code linking to a registry with details such as how to change the default password, how to configure the device securely, whether updates are automatic, and the product's minimum support period end date, or a statement that it is not supported;
• products will be tested by accredited, FCC recognized labs (CyberLABs) and approved by Cybersecurity Label Administrators.

Dated milestones from the FCC's page are in the timeline below. The key point for anyone shopping in October 2026: the FCC says it will announce when the program is ready to accept applications for products to bear the label, and that announcement is not on its page yet. Treat any claim that a thermostat "has the Cyber Trust Mark" with care until the FCC registry exists.

The NIST criteria behind the program are the consumer profile in NISTIR 8425, which builds on the NISTIR 8259A core baseline. NISTIR 8425 says the consumer profile was initially published in NIST's recommended criteria for consumer IoT labeling, as part of NIST's response to Executive Order 14028.

Dated timeline: smart thermostat standards, labels and support

Step by step: update, isolate, review and plan for end of support

These steps are for the thermostat you own, on your own network. None of them involve opening the device.

1. Find the model and firmware version

Look in the thermostat's on screen settings (often under an "About", "Information" or "Technical info" menu) or in the vendor app. Google's end of support page notes that you can confirm the model, serial number and software version of a Nest thermostat in the Nest or Home app. Write down:

Model / generation:
Serial number:
Firmware version:
Date checked:
Vendor support period (from the vendor's published policy):

2. Check that automatic updates are on

Most cloud thermostats update automatically and do not offer a switch. If yours has an update setting, turn on automatic updates. If the version number has not changed in a long time, check the vendor's release notes or support page for the latest version for your model.

3. Put the thermostat on a separate IoT network

A separate network segment limits what the thermostat can reach, and what can reach it, if any device on that segment misbehaves. Many consumer routers offer a "guest" or "IoT" network that isolates clients. On routers with VLAN support, you can create a dedicated VLAN. The example below is for a Linux based router using nftables, with the LAN on br-lan, the IoT VLAN on br-iot and the internet on wan. Adapt names to your router; it is an example, not a drop in configuration.

# Create VLAN 30 on the LAN switch port and give it its own subnet (example only)
ip link add link eth1 name eth1.30 type vlan id 30
ip addr add 192.168.30.1/24 dev eth1.30
ip link set eth1.30 up

# /etc/nftables.d/iot.nft  (example policy)
table inet iotfilter {
  chain forward {
    type filter hook forward priority 0; policy drop;
    ct state established,related accept
    iifname "br-lan" oifname "br-iot" accept     # LAN may reach IoT (for apps and Matter controllers)
    iifname "br-iot" oifname "wan" accept        # IoT may reach the internet (cloud, updates, time)
    iifname "br-iot" oifname "br-lan" drop       # IoT may not start connections into the LAN
  }
}

# Load and confirm the rules
nft -f /etc/nftables.d/iot.nft
nft list table inet iotfilter

Two cautions. First, a thermostat that cannot reach its update servers will stop updating, so allow outbound internet access unless you are deliberately running it local only. Second, Matter and many apps discover devices with multicast DNS, and Matter uses IPv6. Splitting the controller and the thermostat across subnets can break discovery and commissioning unless your router reflects mDNS or you keep the Matter controller and Thread border router on the same segment as the device. Test after each change.

4. Check what the thermostat exposes on your network

From a computer on the LAN, list the thermostat's address in your router's client table, then check which ports it answers on. Only scan devices you own on networks you manage.

# Find open TCP ports on your own thermostat (replace the address)
nmap -sT -Pn 192.168.30.25

A cloud thermostat often has no open ports, because it only makes outbound connections. A Matter or local API thermostat will answer on the ports those protocols use. Unexpected open services are worth a support ticket to the vendor.

5. Secure the account

Turn on two factor authentication for the vendor account, review who has access to the home, and remove old phones and integrations. The account, not the wall unit, is the most common way into a cloud thermostat.

6. Review data sharing and demand response enrolment

In the app, find the settings for data sharing, energy reports, third party integrations, geofencing and any utility or rewards program. Confirm which programs you are enrolled in, what they share, and how to override an event (ENERGY STAR certified products must let you). Unenroll from programs you did not intend to join.

7. Plan for end of support

Find the vendor's published support period and note the date. When support ends, the device may still heat and cool, but it will no longer receive security fixes, and cloud features may stop entirely, as happened when the first and second generation Nest Learning Thermostats were removed from the apps on 25 October 2025. Options at end of support: replace the thermostat, move it to a network segment with no internet access and accept local only use, or use it with a local Matter controller if it supports Matter. Recycle the old unit through the vendor's or your local program.

8. Before any physical replacement

Turn off power to the HVAC system at the breaker, confirm it is off, photograph and label every wire before disconnecting, and compare the terminals with the new thermostat's compatibility checker. If you see thick wires, wire nuts with multiple heavy conductors, or 120 or 240 volt markings, stop: that is a line voltage system and needs an electrician.

Common mistakes

• Assuming wire colors mean something. The terminal letters on the old thermostat are what matter, and even those can be wrong in older homes. Label wires by terminal before disconnecting.
• Installing a low voltage smart thermostat on a line voltage heater. It is not compatible and the mains voltage is dangerous. ENERGY STAR's specification excludes line voltage thermostats for a reason.
• Ignoring the C wire question. Power stealing works on many systems, but heat pumps, zoned systems and some electronic control boards misbehave. Short cycling, random restarts or a draining battery are power problems.
• Setting the wrong reversing valve mode on a heat pump. O and B are opposites; the wrong setting heats when you ask for cooling.
• Placing the thermostat in a bad spot. Near a supply register, in direct sun, on an exterior wall or above a lamp, the sensor reads the wrong temperature and the whole control loop follows it.
• Blocking all internet access to "secure" it. You also block security updates. Isolate the device from your LAN, not from its update service, unless you have decided to run it local only.
• Forgetting the account. Reusing a password on the vendor account leaves the thermostat open to credential stuffing no matter how good the firmware is.
• Enrolling in demand response without reading the terms. Know what data you share and how to override an event.
• Not checking the support period before buying. A cheap thermostat with an unknown or short support window can cost more over ten years than one with a published, longer commitment.
• Treating a label as current. ENERGY STAR Version 1.0 is about energy, not security, and the FCC has not yet opened the Cyber Trust Mark to product applications as of October 2026.

FAQ

How is a smart thermostat made?

Engineers design a PCB that combines a temperature and humidity sensor, an occupancy sensor, a display, a wireless system on a chip and relays or triacs for the HVAC wires. Factories fabricate and assemble the board, test every unit, calibrate the sensor, write signed firmware and a unique device identity, and fit it into an enclosure with a wall plate of labeled terminals.

What are the parts of a smart thermostat?

The main parts are a temperature sensor (often with humidity), an occupancy or proximity sensor, a display and input, a microcontroller or Wi-Fi SoC (sometimes with Bluetooth and Thread radios), relays or solid state switches for each HVAC function, a power circuit with a battery or supercapacitor, and the firmware that runs it all.

What does the C wire do on a thermostat?

The C (common) wire is the return side of the 24 VAC transformer in your furnace or air handler. It does not switch heating or cooling. It gives the thermostat steady power. Without it, many smart thermostats borrow small amounts of current through the heating and cooling wires, which does not work well on every system.

What is power stealing on a thermostat?

Power stealing, or power sharing, is drawing a small current through an HVAC control wire and the equipment's coil when that function is off, or briefly interrupting a closed circuit when it is on, to charge the thermostat's battery. It avoids the need for a C wire but can cause cycling or false calls on sensitive equipment.

Do smart thermostats work without internet?

ENERGY STAR certified smart thermostats must keep working as a basic thermostat without connectivity to the service provider: you can see the temperature, change the set point and switch between off, heat and cool on the device. Remote control, voice integrations and cloud features stop until the connection returns. Matter local control keeps working on the home network.

What does Matter change for smart thermostats?

Matter gives thermostats a standard, IP based local interface over Wi-Fi or Thread, with Bluetooth Low Energy for commissioning. You pair with a setup code using any Matter controller, the device can be controlled by more than one ecosystem at once, and local commands do not need the vendor cloud.

What data does a smart thermostat collect?

At minimum, ENERGY STAR certified products must be capable of collecting a unique ID, ZIP code, equipment type, daily heating and cooling run times, hourly auxiliary and emergency heat run times, and hourly indoor temperatures and set points. Many also process humidity, occupancy, geofencing and account data. Check the vendor's privacy policy for what is actually sent and kept.

Can my utility control my smart thermostat?

Only if you enroll in a demand response program. The utility or its program operator then sends events, usually through the thermostat maker's cloud, that adjust your set point for a few hours. ENERGY STAR requires certified products to let you override any demand response signal.

What is the US Cyber Trust Mark?

It is the FCC's voluntary cybersecurity label for wireless consumer IoT products, based largely on NIST criteria, with a QR code linking to support period and update information. The rules were adopted in March 2024. As of October 2026 the FCC has named a lead administrator and recognized accreditation bodies, but has not yet announced that products can apply for the label.

How long do smart thermostats get security updates?

It depends on the vendor's published policy. Google, for example, commits to automatic critical security updates for Google Nest devices for at least 5 years from the date it starts selling them. When support ends, the device may still control your HVAC locally but no longer receives fixes.

Where Safeguard fits, honestly

Safeguard does not analyze thermostat hardware, scan firmware images, manage or monitor home devices, or generate hardware bills of materials, and it has nothing to say about relays, sensors or HVAC wiring. The honest overlap is the software around the thermostat. Thermostat firmware is built from open source components such as RTOS kernels, network stacks, TLS libraries and Matter SDK code, and the companion apps, cloud services, demand response integrations and energy dashboards are ordinary software projects with open source dependencies. For teams that build that software, the same dependency hygiene applies as for any web service: know which components and versions each build ships, find the ones with known vulnerabilities, and upgrade them before they reach production. If that code lives in a repository or container image, Safeguard can scan it (for example safeguard scan --dir . on a checkout, or safeguard scan --image followed by an image name), match components against vulnerability databases, rank findings with reachability analysis and open fix pull requests when you switch autonomous remediation on. It does not replace the owner steps above.

A rebuilt thermostat cloud service or demand response integration pulls every dependency again, and firmware and companion apps ship many open source components. That is where supply chain hygiene still matters for a device that sits on a wall, and it is where the section below applies.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE: it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same flow fits a thermostat companion web app or an energy dashboard your team maintains in a JavaScript repository.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. That suits an embedded or IoT team that prefers to scan firmware build repositories and integration services locally rather than connect them to a hosted service.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and shows how you choose which tools Claude can use. A team that asks an assistant about the dependencies in its thermostat cloud services can keep that assistant limited to the read and scan tools it actually needs.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• ENERGY STAR, Smart Thermostats product page
• ENERGY STAR, Smart Thermostats Key Product Criteria
• ENERGY STAR, Program Requirements for Connected Thermostats Version 1.0 (PDF, rev. January 2017)
• FCC, U.S. Cyber Trust Mark
• NIST, NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline (May 2020)
• NIST, NISTIR 8425, Profile of the IoT Core Baseline for Consumer IoT Products (September 2022)
• ETSI, EN 303 645 V3.1.3 directory
• IETF, RFC 9019, A Firmware Update Architecture for Internet of Things
• IETF, RFC 9124, A Manifest Information Model for Firmware Updates in IoT Devices
• Connectivity Standards Alliance, Matter
• Thread Group, What is Thread
• OpenADR Alliance, Overview
• Google Home and Nest Help, Learn about the common or C wire
• Google Home and Nest Help, End of support for Nest Learning Thermostats (1st and 2nd gen)
• Google Safety Center, Nest privacy commitments

Last reviewed: 24 October 2026.