Trane XL950 Thermostat

Does anyone know how to set up the Trane XL950 on the Vera 2? Looks like it will be through IP as it’s connected to my home network. I’ve enabled remote services on the XL950 but don’t know how to add the device on the Vera 2.

Let us know how it works once you get it working. I thought they were coming out with a model with Z-wave capable later this year, or maybe the radio is already in the unit and just not enabled yet? I was seriously looking into this model, but needed the remote temperature control that was offered by the Honeywell Pretige HD unit. Does Train have a remote unit planned for the XL950?

You can have up to 5 wireless zone temp controls and have damper control to go with it. Hopefully the z-wave will come around as the trane rep told me it was a firmware upgrade.

Great. I find these HVAC companies are mostly clueless. If you look at all the XL-950 advertising they are touting it as an iPad want to be. Get your weather, photo pictures, etc. on the device. Sorry, but I don’t plan on playing Angry Birds with a wall mounted Thermostat. They are clueless. How about making an HVAC controller with more features and give me proper control (both inside and outside the house) over fan programming, humidity control, etc. The XL-950 still looks like the most promising of the bunch, but the last I heard they are trying to charge you a monthly fee for the remote access features. Maybe that is just because of their recommended Schlage Link access, that you could easily get around. Anyway, I will sit tight for a while until the features get flushed out properly.

Did you purchase and install this yourself or by the hvac guy? I currently have a Trane system with the comfortlink 2 communicating thermostat. This seems to be the only way to add some sort of zwave functionality. There are really no other thermostats that I have found that are communicating (data wire).

Have you had any luck connecting to Vera?

The thermostat was installed by the HVAC company and he did a good job. The firmware update is not out yet to allow it to communicated via the network. I’ve been told by Trane that it would be out in the Fall. Hopefully it will be straight forward at that time. They have already come out with the 950XL brochures and Schlagelink zwave capabilities but at this time it does not work.

I just had one installed with my new AC/Heating System. Talked with Trane Support only to find out that Schlage’s Servers can only concoct to your Thermostat. If you can only connect to your thermostat through the Schlage’s Servers (Intra or Internet). Their service will not be available to mid to late fall (October/November) and the cost to connect to your Thermostat from you own house sitting on your couch using your own network will be $8.99 per month. However that will give you the 1st 6 months for free.

Not what I was expecting. Very disappointed with that news.

I’m hoping that someone will find a way once its available. For those of us with the proprietary communicating system, we’re kind of stuck.

I just installed one of these thermostats, found it on eBay for cheap. It is a real nice thermostat, I really do like the interface. I did notice that you can ssh from a linux terminal into the thermostat’s IP address, but I don’t know what the user/pass would be.

I guess we just need to wait for the firmware update to find out what we can do.

I got the firmware update today to version 2.0 and it now has and “enable Schlage Link” option. When I click it, there is a request for a validation code. Looks like it’s beyond my ability to connect to the MCV.

Anyone have any ideas?

Well, I just upgraded mine as well. I’m playing around. Vera can’t see it, so either there isn’t a zwave chip or its not activated.

It is running a linux os. I tried to ssh into the IP that it got from my router, but it’s password protected. If anyone knows what it would be, that could help.

Ran a port scanner, it does have some open.

 Open TCP Port: 	22     		ssh
 Open TCP Port: 	8887
 Open TCP Port: 	8888   		ddi-tcp-1
 Open TCP Port: 	9035
 Open TCP Port: 	9037
 Open TCP Port: 	9038
 Open TCP Port: 	9039
 Open TCP Port: 	9040
 Open TCP Port: 	9999   		distinct
 Open TCP Port: 	10001  		scp-config
 Open TCP Port: 	10999
 Open TCP Port: 	11000  		irisa
 Open TCP Port: 	55792
 Open TCP Port: 	57247

Might be time to compile up Hydra for your platform… 8)

Then run a dictionary against it, including a few vendor specific passwords (like xl950, schlage, etc)

Can anyone point me to a URL where I can download the XL950 firmware Version 2 update ? My thermostat came with Version 1, but you need v2 in order to access the SchlageLink Zwave connectivity. (Trane’s literature says the downlaods available on their website- but I’ll be darned if I can find it). Thanks in advance for any suggestions.

:-\ Thanks for the URL. I looked at every link from that page, and cannot find one that references or leads to a software download. I appreciate your trying though!

Go to the Additional Information tab that is where the download lives - saw this T-Stat at CES last year and it was only IP not Z-Wave. Went through all the documentation I could find - the only mention of Z-Wave I could was in relation to the Link System not the T-Stat itself.

I recently purchased a XL950 ComfortLink II, and as my user name suggests I want SSH access to this device :slight_smile:

After poking around the latest firmware update, I found what appears to be an /etc/shadow file listing roots hashed and salted password. I have attached it to this message as this forum thinks its a link.

I have been attempting to crack the password using John the Ripper but so far it has been unsuccessful. Hopefully someone with more resources may be able to get at this password. I am also curious why “pcap” is installed on the machine, is our thermostat watching us??? :slight_smile:

So i’ve got a couple more quotes and now i think it will have to be an XL15i or an XL20i.

My question is what should the appropriate air handler be for both these systems? I was asking for a Hyperion air handler since it’s newer but does the XL20i not communicate with the Hyperion Tam7?

Here is the quote before any rebates. A little higher than the other quotes i’ve been getting, but they’re sealing the ductwork and installing 3 more returns and including the trane 10 year parts and labor warranty. and after the austin energy rebates the modifications will be free.

all for 4ton systems

XL15i - $10,007

XL20i- $11,657

A couple questions, are these fair prices? Are the air handlers adequate or should i be looking for the 4TEE-C handlers with the XL20i Quote and would this be more expensive? Should I ask for an XL19i quote instead of the 20i? Would the 20i save money in electricity compared to the XL15i due to the 2 compressors?

Hi IwantSSH,

I followed in your footsteps and I was also able to read the contents of /etc/shadow. But there are actually 2 versions of this file stored in 2 different file system image files!

This is how to get the upgrade files:

  1. Download the XL950 software upgrade from, run the installer, and extract the files to a directory.

The first file system file is b_132090800701. It’s a GZIPed ext2 image file. This is how to read its contents (including /etc/shadow):

  1. Rename b_132090800701 to b_132090800701.gzip.
  2. Use a program that can uncompress GZIP to extract the file rootfs.ext2.
  3. Use software such as Ext2 Installable File System For Windows to mount rootfs.ext2 and access its contents (including /etc/shadow).

The second file system file (and probably the one that matters) is c_132090800701. It’s a jffs2 image file. This is how to read its contents (including /etc/shadow):

  1. Use a program such as jffs2reader.exe to extract the file. You can get jffs2reader from here:

I should add that I tried to mount c_132090800701 on a Linux box in order to read/write its contents, but after unsuccessful spending a day on this, I found jffs2reader.exe which can only read (not write).

One possible way to convince the XL950 to allow you to SSH into it, would be to replace the contents of /etc/shadow with your own in order to add your own known set of credentials. The idea is to then apply these changes by performing the normal XL950 software upgrade process. Subsequently, you should be able to SSH into the XL950 using the credentials that you added to /etc/shadow.

Doing so, would modify the contents of either b_132090800701 or c_132090800701 (take our pick). This means that the SHA1 hash would no longer match the one specified in m_132090800701. So after modifying either b_132090800701 or c_132090800701, you would have to recalculate the SHA1 hash and would need to change it in m_132090800701.

Unfortunately, c_132090800701 is probably the image that’s used by the XL950 to run normally. I think that b_132090800701 is used during the upgrade process, so modifying its contents would probably not buy you anything.

Disclaimer: I have not tried changing anything and I don’t know if any of this will work. This might even break things. If you do this, please make sure that you are willing to accept all the risks associated with doing so.

Good luck! Please let us know if you tried this and if it worked.

I have a schlage gateway, would I be able to set it up and have it communicate with the Vera2? I’d subscribe to the monitoring fee for a month to allow me to get it on the network then cancel the service. I’m wondering if it would still show up or if it’s possible to have two gateways on the same network.

Anyone know if this is an option?

Has anyone that had posted here previously figured out how to get the Trane Comfortlink II to work with Vera? Is it confirmed that the thermostat actually does not have a z-wave chip? So far I haven’t found anyone that’s able to get this unit to work on anything other than the Schalge Link system. I’m very interested in getting Vera 3 and getting this thermostat as well, but i’m concerned that the two will never be able to communicate and live up to their full potential.