My eq-3 Bluetooth Radiator Thermostat CC-RT-BLE is just showing "UPD". How can I "unbrick" it?
The official statement is that if you have no calor BT app that is currently paired, you are lost and should return the device to the dealer as broken.

However, there is a way out - the following steps are written for a Linux environment but probably can be adapted to other OSes:


Install a current (!) VirtualBox and VirtualBox Extension Pack for USB support
Blacklist btusb module and possibly more specific device drivers like ath3k if it applies to your system to keep the Bluetooth USB device unoccupied (revert this later!); give chmod a+rw permission to the USB device file under /dev/bus/usb/xxx/yyy, see lsusb
Install RemixOS in a VirtualBox VM, add a USB device filter to expose your Bluetooth chip to RemixOS
Install calor BT on RemixOS, run it at least once
Determine the device Bluetooth address: Open the device by unscrewing the four screws, then gently pulling the turning knob outwards, remove the cover; locate the "ADDRESS" QR code printed on the front of the circuit board; scan the QR code to retrieve the Bluetooth adress in form M001A22XXYYZZ (I had to take a picture, crop it and then run the QR scanner on the image); the Bluetooth address then is 00:1A:22:XX:YY:ZZ; replace the cover, again gently pulling the turning knob outwards, turn it to make it fit the turn encoder; screw the cover
Manually set up the calor BT configuration to address the bricked device. Save this as container.json, replacing all XX:YY:ZZ by the address determined above:

{"clients":{},"devices":{"00:1A:22:XX:YY:ZZ":{"availableFirmwareVersion":null,"firmwareVersion":null,"groupId":"17f51411-4be0-4155-98f6-9a03bbde5681","groups":[],"id":"00:1A:22:XX:YY:ZZ","label":"Device","lastStatusUpdate":0,"lowBat":false,"unreach":false,"updateState":null,"operationLockActive":false,"temperatureOffset":0,"valvePosition":null,"type":"HEATING_THERMOSTAT"}},"groups":{"17f51411-4be0-4155-98f6-9a03bbde5681":{"channels":null,"devices":["00:1A:22:XX:YY:ZZ"],"homeId":null,"id":"17f51411-4be0-4155-98f6-9a03bbde5681","label":"Room","lastStatusUpdate":0,"lowBat":null,"metaGroupId":null,"unreach":null,"activeProfile":null,"actualTemperature":null,"boostDuration":0,"boostMode":false,"controlMode":"AUTOMATIC","maxTemperature":29.5,"minTemperature":5,"nextSwitchPoint":null,"profiles":null,"setPointTemperature":17,"windowOpen":null,"windowOpenTemperature":12,"type":"HEATING"}},"home":{"absenceEndTime":"","absenceType":"NOT_ABSENT","availableAPVersion":null,"clients":[],"connected":false,"currentAPVersion":null,"deviceUpdateStrategy":null,"ecoDuration":null,"ecoTemperature":0,"groups":["17f51411-4be0-4155-98f6-9a03bbde5681"],"id":null,"lastReadyForUpdateTimestamp":0,"location":null,"nonAbsenceGroups":[],"pinAssigned":false,"powerMeterCurrency":null,"powerMeterUnitPrice":0,"timeZoneId":"","updateState":"UP_TO_DATE","dutyCycle":null},"metaGroups":{},"weather":{"temperature":0,"weatherCondition":"UNKNOWN","weatherDayTime":"DAY"},"homeGroup":null,"inboxGroup":null}

Maybe use http://www.jsoneditoronline.org/ to edit this.
Now, install this configuration inside RemixOS: make sure the VM is shut down
Mount the RemixOS VM image, first making the VM image available as a block device (using qemu-nbd from qemu-tools):

modprobe nbd
qemu-nbd -c /dev/nbd0 --partition 1 &lt;path to RemixOS.vdi&gt;

Now mount it: mount /dev/nbd0 /mnt
Copy container.json to /mnt/android-2016-06-30/data/data/de.eq3.ble.android/app_data/ (might vary depending on RemixOS version)
Unmount the RemixOS image:

umount /mnt
qemu-nbd -d /dev/nbd0

Boot up RemixOS; run calor BT; go to "Room", then "Device", then "Update firmware"
Firmware should be transferred (showing moving bars next to "UPD" on the device), then rebooted, device is then going to "InS" mode, turn it off and on again to enter date setup, etc.


If this fails during firmware transfer: Keep trying, set the VirtualBox USB mode to 3.0 - I had to try really hard to get this done.