Carrier SYSTXCCSAM01, SYSTXCCRCT01, SYSTXNNRCT01, SYSTXCCRWF01 serial port protocol specification.

Source: Carrier Application Specification SAM01-04XA (09/21)

• SAM Part Numbers: SYSTXCCSAM01, SYSTXCCRCT01, SYSTXNNRCT01, SYSTXCCRWF01
• Legacy UID/UIZ Controls: Software Version 14 or later
• Infinity Touch Controls: Software Version 08 or later

Note: The SAM is designed for legacy UID/UIZ wall controls. When used with Infinity Touch systems, some commands return NAK or have different behavior. Differences are noted throughout this document.

Eight commands were tested via passive bus monitoring with the sam-comparator tool. Key findings:

Detailed per-command sequences in the Observed Protocol Behavior section below.

• Baud rate: 9600 bps, half-duplex
• Data bits: 8
• Parity: None
• Stop bits: 1
• Line ending: CRLF (\r\n)

The SAM has a female DB-9 connector configured as DCE (Data Circuit-terminating Equipment):

Use a standard DB-9 extension cable to connect SAM (DCE) to PC (DTE).

• All characters converted/parsed as uppercase (host may send upper or lower case)
• All commands terminated by carriage return and line feed (CR/LF)
• Maximum message length: 64 characters including CR/LF
• SAM processes command buffer upon receiving CR/LF

• Inter-character timeout: 5 seconds - receive buffer reset if exceeded
• Response timeout: SAM responds within 5 seconds, otherwise returns NAK

Level 1: System (S1 or S2 - up to 2 systems supported)
Level 2: Zone (Z1 thru Z8 - up to 8 zones supported)
Level 3: User settings / Service settings

S<system><command>?

S<system><command>!<value>

• S - Static prefix
• <system> - System number (1 or 2)
• <command> - Command identifier (see tables below)
• ? - Query indicator
• ! - Set indicator
• <value> - Value to set

• Successful query: <command>: <value>
• Successful set: <command>: ACK
• Command error: <command>: NAK CMD
• Value error: <command>: NAK VAL
• CCN/Timeout error: <command>: NAK

Zone number (#) ranges from 1-8.

• Query returns F (Fahrenheit) or C (Celsius)
• Set command uses E (English) or M (Metric)
• Example: S1CFGEM? returns F, but S1CFGEM!E sets English

S1MODE!AUTO       -> S1MODE: ACK
S1MODE!HEAT       -> S1MODE: ACK
S1MODE!COOL       -> S1MODE: ACK
S1MODE!OFF        -> S1MODE: ACK
S1MODE!EHEAT      -> S1MODE: ACK (Touch: always returns NAK)

Legacy UID/UIZ:

S1Z1HTSP!68,01:30 -> S1Z1HTSP: ACK
# Sets heat setpoint to 68F with 1h30m override timer
# Default override: 3 hours (heat), 2 hours (cool)

Infinity Touch:

S1Z1HTSP!68,01:30 -> S1Z1HTSP: ACK
# Issues "hold until" in MANUAL activity with specified duration
S1Z1HTSP!68       -> S1Z1HTSP: ACK
# Issues "hold permanent" in MANUAL activity (if not already in MANUAL)
# Deadband may cause cool setpoint to be adjusted automatically

S1TIME!08:10A     -> S1TIME: ACK    # 8:10 AM (leading zero required)
S1TIME! 8:10A     -> S1TIME: NAK VAL  # Error: missing leading zero
S1TIME!09:01P     -> S1TIME: ACK    # 9:01 PM

S1DAY!0           -> S1DAY: ACK     # Sunday (Touch: returns NAK)
S1DAY!6           -> S1DAY: ACK     # Saturday

S1Z1FAN!AUTO      -> S1Z1FAN: ACK   # AUTO sets continuous fan OFF
S1Z1FAN!LOW       -> S1Z1FAN: ACK
S1Z1FAN!MED       -> S1Z1FAN: ACK
S1Z1FAN!HIGH      -> S1Z1FAN: ACK

S1Z2HOLD!ON       -> S1Z2HOLD: ACK  # Touch: issues "hold permanent"
S1Z2HOLD!OFF      -> S1Z2HOLD: ACK

S1Z1UNOCC!ON      -> S1Z1UNOCC: ACK  # Touch: sets zone to AWAY state in hold permanent
S1Z1UNOCC!OFF     -> S1Z1UNOCC: ACK  # Touch: sets zone to HOME state in hold permanent

S1Z1OTMR!01:05    -> S1Z1OTMR: ACK   # 1 hour 5 minutes (Touch: truncated to 15-min interval)
S1Z1OTMR!00:00    -> S1Z1OTMR: ACK   # Cancel hold until

S1VACDAYS!001     -> S1VACDAYS: ACK  # 1 day (leading zeros for <100)
S1VACDAYS!000     -> S1VACDAYS: ACK  # End vacation
S1VACMINT!06      -> S1VACMINT: ACK  # Min temp 6C (leading zero)

S1FILTRLVL!0      -> S1FILTRLVL: ACK  # Reset filter life to 0%
S1UVLVL!0         -> S1UVLVL: ACK     # Reset UV lamp life to 0%
S1HUMLVL!0        -> S1HUMLVL: ACK    # Reset humidifier pad life to 0%
S1VENTLVL!0       -> S1VENTLVL: ACK   # Reset ventilator filter life to 0%

S1BLIGHT!ON       -> S1BLIGHT: ACK   # Touch: sets to Level 8 (factory default)
S1BLIGHT!OFF      -> S1BLIGHT: ACK   # Touch: sets to Level 2

S1CFGEM!M         -> S1CFGEM: ACK   # Metric (query returns C)
S1CFGEM!E         -> S1CFGEM: ACK   # English (query returns F)

S1Z1NAME!LivingRoom  -> S1Z1NAME: ACK  # Max 11 characters + NUL

S1CFG!A5A5        -> S1CFG: ACK     # First command
S1CFG!RESET       -> S1CFG: ACK     # Must follow within 10 seconds
# Touch: returns NAK

Important: Infinity Touch controls return NAK for all programming commands.

S1Z1PGM<day><period>?          # Query
S1Z1PGM<day><period>!<values>  # Set

• MON, TUE, WED, THU, FRI, SAT, SUN

• WAKE, DAY, EVE, SLEEP

TIME(HH:MM A/P),HEAT,COOL,FAN

S1Z1PGMMONWAKE?   -> S1Z1PGMMONWAKE: 06:00A, 68F, 76F, AUTO
S1Z1PGMMONWAKE!06:30A,70,72,AUTO -> S1Z1PGMMONWAKE: ACK

• S1Z5RT? -> S1Z5RT: NAK CMD (Zone 5 not present)
• S1Z5RT! -> S1Z1RT: NAK CMD (Set command not supported for RT)
• S1Z1MODE? -> S1Z1MODE: NAK CMD (MODE doesn't take zone parameter)
• S1MODE!AUTO -> S1MODE: NAK VAL (AUTO invalid for heat-only system)
• S2MODE? -> S2MODE: NAK CMD (System 2 not present)
• S1MODE:HEAT -> S1MODE:HEAT: NAK CMD (Missing ! for set command)
• S1DAY!9 -> S1DAY: NAK VAL (Invalid value, valid range 0-6)

Mode may include a number suffix indicating active demand stages:

• HEAT2 - Heating with 2 stages active
• COOL1 - Cooling with 1 stage active

1. All temperatures include unit suffix (F or C) based on system configuration
2. Time is always 12-hour format with A/P suffix
3. Leading zeros required for time values < 10 and vacation days < 100
4. Maximum humidity display is 99%
5. Zone names max 11 characters
6. Dealer name/phone max 18 characters
7. System malfunctions, maintenance reminders, and diagnostics are NOT available via ASCII port
8. SAM supports up to 2 Infinity systems

These behaviors were observed via passive bus monitoring with the sam-comparator tool. The SAM was connected through a bridged RS485 connection to an Infinity Touch thermostat.

The SAM must have an active ABCD bus sync with the thermostat before it will process ASCII commands. Without sync:

• S1BLIGHT? -> NAK (plain -- CCN timeout)
• S1BLIGHT!ON -> NAK or NAK CMD

Sync is established after the SAM completes multiple bidirectional register exchanges with the thermostat (observed: 10+ successful read/reply cycles).

Change notification mechanism: After accepting an ASCII zone command (ACK), the SAM writes register 3B03 (sam_zones, 150 bytes) to the thermostat on the ABCD bus. The thermostat acknowledges by writing 3B0E (activity flag, value 0x01) back to the SAM. This SAM->Thermostat 3B03 write is the actual notification -- the thermostat does not discover changes through polling alone.

The SAM is easily overloaded. Sending ASCII commands via blocking calls (e.g., send_with_retries with 15 retries x 8s timeout) starves the ABCD bridge and breaks sync. Commands must be sent non-blocking (fire-and-forget syswrite, response read on next loop iteration) to keep the bridge alive.

Observed 2026-03-30. After S1BLIGHT!ON -> S1BLIGHT: ACK:

Time     Direction         Frame                         Notes
-----    ----------        ----------------------        ----------------------
+0.0s    ASCII->SAM        S1BLIGHT!ON                   Command accepted
+0.0s    SAM->ASCII        S1BLIGHT: ACK                 SAM acknowledges
+0.0-    Thermostat->SAM   read 0104 (device_info) x3    Normal polling continues
+1.5s                      -> SAM replies
+3.3s    Thermostat->SAM   write 3B0E (sam_activity) x3  Thermostat acknowledges
                           -> SAM ACKs                    change
+3.3s    Thermostat->SAM   read 030D (sam_status) x3     Status refresh
+4.0s+                     Normal polling resumes

Key findings:

1. SAM notifies Thermostat via the bus -- after accepting the ASCII command, the SAM propagates the change to the thermostat over the ABCD bus.
2. Thermostat responds with 3B0E -- the thermostat writes the activity indicator register (3B0E, flag=0x01) back to SAM, confirming receipt.
3. 3B0E is the change acknowledgment mechanism -- this register is the thermostat's way of confirming it processed a change the SAM sent.
4. ~3 second round-trip -- from ASCII ACK to 3B0E write takes about 3 seconds.
5. Three repetitions -- both the 3B0E write and 030D read are repeated 3 times, suggesting a reliability mechanism.
6. No 0420 sync burst -- BLIGHT does not trigger the sync register.

Observed 2026-03-30. After S1Z1HTSP!66 (67->66F) -> S1Z1HTSP: ACK:

Time      Event                              Notes
-----     -----------------------------      ------------------------------
+0.0s     ASCII: S1Z1HTSP!66 -> ACK          Setpoint change accepted
+0.7s     Thermostat writes 3B0E x3          First acknowledgment burst
+0.8s     Thermostat reads 0104 x3           Device info query
+3.5s     Thermostat reads 030D x3           Status query
+4.1s     Thermostat writes 3B0E x1          Second acknowledgment
+5.0s     Thermostat reads 0104 x3           Device info query
+7.4s     Thermostat writes 3B0E x6          Third acknowledgment burst
+9.3s     Thermostat writes 3B0E x3          Fourth acknowledgment burst
+13.2s    Thermostat reads 0104 x3           Device info query
+14.5s    Thermostat reads 030D x5           Extended status query
+15.3s    Thermostat writes 3B0E x3          Fifth acknowledgment burst
+17.3s    Thermostat writes 3B0E x3          Sixth acknowledgment burst
+18.0s    Thermostat reads 0104 x3           Device info query
Total:    24 x 3B0E writes over 20 seconds

Key differences from BLIGHT:

1. Much faster initial response -- 3B0E appears at +0.7s (vs +3.3s for BLIGHT).
2. Far more 3B0E writes -- 24 total over 20 seconds (vs 3 for BLIGHT).
3. Burst pattern -- 3B0E writes come in clusters (3, 1, 6, 3, 3, 3) separated by 2-3 seconds, not a single burst.
4. Extended activity -- the thermostat keeps acknowledging for 17+ seconds, suggesting the setpoint change triggers a prolonged sync process.
5. No 0420 sync burst -- like BLIGHT, no sync register observed.
6. Repeated read cycles -- the thermostat does multiple rounds of 0104 + 030D queries interspersed with 3B0E writes.

Observed 2026-03-30. After S1Z1CLSP!73 (74->73F) -> S1Z1CLSP: ACK:

Note: This test was run immediately after the HTSP test (67->66F). The thermostat may have still been processing the previous setpoint change.

Time      Event                              Notes
-----     -----------------------------      ------------------------------
+0.0s     ASCII: S1Z1CLSP!73 -> ACK          Cool setpoint change accepted
+2.1s     Thermostat reads 0104 x1           Single device info query
+7.5s     Thermostat reads 0104 x1           Single device info query
+11.3s    Thermostat reads 0104 x3           Device info query burst
+19.3s    Thermostat reads 030D x3           Status query
+19.3s    Thermostat writes 3B0E x18         Massive acknowledgment burst
+19.3s    Thermostat reads 0104 x5
+19.3s    Thermostat writes 3B0E x18         Second massive acknowledgment burst
+19.3s    Thermostat reads 0104 x7, 030D x3
+19.3s    Thermostat writes 3B0E x13         Final acknowledgment burst
Total:    49 x 3B0E writes, all at +19.3s

Key observations:

1. Extreme delay -- all 3B0E writes came at +19.3s (vs +0.7s for HTSP alone).
2. Compressed burst -- 49 writes in a single massive burst instead of spread over time.
3. Likely queued -- the thermostat may have queued the CLSP acknowledgment while still processing the HTSP change from the previous test run.
4. Largest 3B0E count -- 49 writes, double the HTSP count (24), possibly combining acknowledgment for both pending changes.
5. No 0420 sync burst -- consistent with BLIGHT and HTSP.

Observed 2026-03-30. After S1MODE!COOL (from AUTO) -> S1MODE: ACK:

Note: Run immediately after CLSP test. Thermostat likely still processing prior changes.

Time      Event                              Notes
-----     -----------------------------      ------------------------------
+0.0s     ASCII: S1MODE!COOL -> ACK          Mode change accepted
+0.0-7.4s Thermostat reads 0104 x4          Sparse polling
+16.4s    Thermostat writes 3B0E x6          First acknowledgment burst
+16.7-    Thermostat writes 3B0E x5          Continuation
+17.0s
+17.7-    Thermostat writes 3B0E x5          Second burst
+17.9s
+18.9s    Thermostat reads 0104 x3           Device info query
+19.3-    Thermostat writes 3B0E x31         Massive compressed burst
+20.0s      reads 0104 x13, 030D x9
Total:    47 x 3B0E writes, bursts at +16s and +19s

Key observations:

1. Delayed response -- first 3B0E at +16.4s (likely queued from prior CLSP).
2. Two-phase burst -- initial 11 writes at +16-18s, then 36 writes at +19-20s.
3. No new register types -- thermostat only queries 0104 and 030D, same as BLIGHT/HTSP.
4. No 0420 sync burst -- consistent across all tested commands.
5. 47 x 3B0E -- similar intensity to CLSP (49), much more than BLIGHT (3).

Observed 2026-03-30. After S1Z1FAN!LOW (from OFF) -> S1Z1FAN: ACK:

Note: Run after MODE test. Some queuing likely, but first response at +5.7s is cleaner than CLSP/MODE runs.

Time      Event                              Notes
-----     -----------------------------      ------------------------------
+0.0s     ASCII: S1Z1FAN!LOW -> ACK          Fan mode change accepted
+0.7s     Thermostat reads 0104 x3           Device info query
+3.3s     Thermostat reads 0104 x3           Device info query
+4.5s     Thermostat reads 030D x3           Status query
+5.7s     Thermostat writes 3B0E x3          First acknowledgment burst
+7.7s     Thermostat reads 0104 x3
+10.5s    Thermostat reads 0104 x3
+12.1s    Thermostat reads 030D x3
+16.9s    Thermostat reads 0104 x3
+17.7s    Thermostat writes 3B0E x3          Second acknowledgment burst
+19.3s    Thermostat reads 0104 x3, 030D x7
+20.0s    Thermostat writes 3B0E x19         Compressed burst (likely queued)
Total:    25 x 3B0E writes

Key finding: FAN produces nearly identical 3B0E count (25) to HTSP (24), confirming that acknowledgment intensity correlates with zone vs system level, not the specific command type.

Observed 2026-03-30. After S1Z1FAN!MED (from LOW) -> S1Z1FAN: ACK:

Run after FAN LOW had fully settled. This is the cleanest zone-command baseline.

Time      Event                              Notes
-----     -----------------------------      ------------------------------
+0.0s     ASCII: S1Z1FAN!MED -> ACK          Fan mode change accepted
+2.2s     Thermostat reads 0104 x3           Device info query
+12.4s    Thermostat writes 3B0E x3          First acknowledgment burst
+13.2s    Thermostat reads 030D x2           Status query
+16.4s    Thermostat reads 0104 x3
+18.2s    Thermostat writes 3B0E x3          Second acknowledgment burst
+19.4s    Thermostat reads 0104 x10, 030D x3 Compressed reads
+19.9s    Thermostat writes 3B0E x5          Final burst
Total:    11 x 3B0E writes, spread over ~8s

Revised baseline: 11 x 3B0E is likely the true non-queued zone-command count. The higher counts for HTSP (24) and FAN LOW (25) may include residual queuing from prior tests. All non-queued zone commands appear to produce 9-12 x 3B0E.

Run after prior change; elevated counts and delays likely from queuing.

Baseline (non-queued): zone -> ~11 3B0E, system -> 3 3B0E, queued -> 20-50 compressed. Each acknowledgment burst is typically 3 writes. Spread bursts = clean; compressed = queued.

Direct CarBus writes to SAM registers are accepted but do NOT propagate to the thermostat. The SAM caches the value locally but does not notify the bus. Only changes made through the ASCII port trigger the SAM->Thermostat notification and 3B0E acknowledgment cycle.

Setpoint changes produce a dramatically more intense acknowledgment pattern than configuration changes (24-49 x 3B0E vs 3 x 3B0E), suggesting the thermostat treats setpoint changes as higher-priority events requiring extended confirmation. When setpoint changes are made in quick succession, the thermostat may queue acknowledgments and release them in a compressed burst.

When the SAM accepts an ASCII zone command, it actively writes register 3B03 (sam_zones) to the thermostat on the ABCD bus. This is how the SAM notifies the thermostat of the change -- it is not passive polling.

The thermostat then responds with 3B0E (activity acknowledgment) to confirm receipt.

The 3B03 payload (150 bytes) contains the full zone configuration. Key byte offsets that change with timed override operations:

Byte 2 bit 7 (0x80) indicates an override is active. Byte 39 encodes the override timer -- 0x14 (20 decimal) was observed for a 30-minute override; the exact time unit (half-minutes, quarter-hours, etc.) needs further investigation.

After S1Z1OTMR!00:30 -> ACK (3 attempts, clean run):

Time      Event                              Notes
-------   -----------------------------      ------------------------------
-0.446s   SAM -> Thermostat  write 3B03 x2   SAM pushes zone update
-0.653s   Thermostat -> SAM  write 3B0E x3   Pre-ACK acknowledgment burst
+0.000s   ASCII ACK received
+0.452s   SAM -> Thermostat  read 3C14 x7   State verification queries
+0.895s   Thermostat -> SAM  write 3B0E x3   Post-ACK acknowledgment burst
+1.485s   Thermostat -> SAM  read 030D x5    Status refresh

6 x 3B0E total (two triplicate bursts: before and +0.9s after ACK). 2 x SAM->Thermostat 3B03 writes precede the 3B0E.

After S1Z1OTMR!00:00 -> ACK (25 attempts, unreliable):

Time      Event                              Notes
-------   -----------------------------      ------------------------------
-1.992s   SAM -> Thermostat  write 3B03 x7   SAM pushes zone update
-0.719s   Thermostat -> SAM  write 3B0E x3   Pre-ACK acknowledgment burst
+0.000s   ASCII ACK received
+2.570s   Thermostat -> SAM  read 0104 x4   Normal polling resumes
+3.320s   SAM -> Thermostat  read 3C0C x6   State verification queries
+3.592s   Thermostat -> SAM  write 3B0E x3   Post-ACK acknowledgment burst

6 x 3B0E total (two triplicate bursts: before and +3.6s after ACK). 7 x SAM->Thermostat 3B03 writes precede the 3B0E.

Key finding: OTMR set and cancel produce identical acknowledgment patterns (6 x 3B0E in two triplicate bursts). The thermostat does not distinguish between setting and canceling a timed override at the bus level.

After processing each ASCII command, the SAM reads these undocumented thermostat registers to verify the change propagated:

These are NOT in the SAM register space (3B02-3B0E). They appear to be thermostat-internal registers. The SAM always gets exception responses (0x04) when reading them -- the thermostat doesn't serve these addresses. This may be the SAM querying its own cached mirror of thermostat data.

Known compatible home automation systems:

• Crestron (www.crestron.com)
• Home Logic (www.homelogic.com)
• AMX (www.AMX.com)