[HN Gopher] Attacking My Landlord's Boiler
       ___________________________________________________________________
        
       Attacking My Landlord's Boiler
        
       Author : ericvolp12
       Score  : 343 points
       Date   : 2025-04-22 04:27 UTC (18 hours ago)
        
 (HTM) web link (blog.videah.net)
 (TXT) w3m dump (blog.videah.net)
        
       | willvarfar wrote:
       | I guess your toolbox really shapes your solution space thinking;
       | as I read through this, being completely lost in the whole world
       | of RF whatnot, my mind jumped straight to an alternative attack
       | that better fit my own tooling: could you encase the thermostat
       | in a box that you can mechanically control the temperature of?
        
         | kbuck wrote:
         | Or attach an ESP32 to the boiler's control board that closes a
         | dry contact circuit...?
        
           | unsnap_biceps wrote:
           | That was my first thought on how I would approach it as well.
        
           | mschuster91 wrote:
           | The problem is, if your landlord ever comes around for
           | inspection, or the bloody thing breaks down due to your
           | installation attempt, you can be held liable up to and
           | including getting evicted.
        
             | aceofspades19 wrote:
             | Where can you get evicted for something like that? The
             | worst case is that they would sue your insurance for
             | damages, or you'd have to pay them out of pocket.
        
         | avidiax wrote:
         | This sounds good, except that cooling a box is problematic. He
         | needs the temperature sensor to read low so that it turns on
         | the heat.
         | 
         | That said, if he has access to the interior of the thermostat,
         | I'm sure it won't be difficult to replace the temperature
         | sensor with a circuit to cause it to read either really high or
         | really low on demand.
        
           | toast0 wrote:
           | > This sounds good, except that cooling a box is problematic.
           | He needs the temperature sensor to read low so that it turns
           | on the heat.
           | 
           | Ice pack and desiccant?
        
           | willvarfar wrote:
           | I was literally imagining duck-taping one of those cheap
           | electric "instant cooling" cups over the box on the wall, and
           | running a small incandescent bulb in to be the heating up
           | element.
        
           | dtech wrote:
           | For such a minor use case a peltier element is suitable. Very
           | energy inefficient but you don't need much and it can both
           | heat and cool.
        
         | mjlee wrote:
         | Or, assuming they have physical access to the combi boiler,
         | removing the receiver unit and replacing it with a more Home
         | Assistant friendly combi boiler thermostat.
         | 
         | Probably a 30 minute job if you've never done it before and
         | easily reversible with a little bit of double sided sticky
         | tape, which all Brits should be familiar with if they ever made
         | a Tracy Island. There is a real risk of electrocution which
         | could be completely militated against by turning off the power
         | to the boiler.
         | 
         | Still, a fun hack, and nicely executed!
        
         | haileys wrote:
         | I removed the thermistor from inside my wall controller and
         | wired in a digital pot instead. Achieves the same thing without
         | physically heating and cooling the sensor
        
         | nippoo wrote:
         | Yes! You can indeed do exactly this. Look up CoolBot - they do
         | exactly this, by just heating up the existing thermostat
        
         | anal_reactor wrote:
         | I've heard a story of people renting an apartment with locked
         | thermostat to the legally allowed minimum. Tenants would put
         | ice on the thermostat
        
           | Gazoche wrote:
           | I heard that was a well-known trick at my old uni dorm. There
           | was a single thermostat for the whole floor so once people
           | figured out where the sensor was, the ones who lived closest
           | to it would often leave packs of frozen food on it.
        
       | thomashabets2 wrote:
       | If you do want to decode it, it's probably not that hard. I was
       | going to implement the transmission side when I did this, but
       | then I moved.
       | 
       | https://blog.habets.se/2017/04/Decoding-FSK.html
        
       | yurishimo wrote:
       | If OP ever shows up here, you probably could have just replaced
       | the thermostat with one that is compatible with your boiler for
       | less money and headache. The boiler market is fairly open to
       | competition as evidenced by the fact that you could find a
       | Honeywell signal in a random OSS project that also worked.
       | 
       | Good luck with your future apartment customizations!
        
         | glitchcrab wrote:
         | I think you missed where it was explained that the apartment is
         | rented and therefore you cannot modify anything.
        
           | Griffinsauce wrote:
           | Cannot modify _irreversibly_ though right? Something like a
           | Nest or whatever is easy to return to the original state when
           | you leave.
        
           | odiroot wrote:
           | Replacing a thermostat is very easy to do though. And very
           | easy to revert too.
           | 
           | Usually it's just acting as a simple relay (on-off switch) so
           | there's two physical wires.
           | 
           | I've got my Hive thermostat running great with various Bosch
           | and Vaillant boilers. And it works great with HA.
           | 
           | Some newer boilers have 12V "smart" controls but still expose
           | 230V "dumb" call for heating pins.
        
             | mschuster91 wrote:
             | > Usually it's just acting as a simple relay (on-off
             | switch) so there's two physical wires.
             | 
             | Vaillant has a proportional signal as well, and that thing
             | in my old home was 30 years old... [1]
             | 
             | [1]
             | https://www.mikrocontroller.net/topic/126250?page=single
        
             | glitchcrab wrote:
             | Agreed (I set up our dual zone Nest-controllee heating so I
             | know it's not difficult), but what happens if the landlord
             | visits and isn't happy with you having done this? It would
             | be a pain to have to revert this if you knew the landlord
             | was coming.
        
               | nkrisc wrote:
               | Check your local laws. You may be allowed to do something
               | like this by law.
        
             | Tarq0n wrote:
             | OP's thermostat wasn't wired, that's why he'd need the
             | electrician.
        
           | nkrisc wrote:
           | Depends on jurisdiction, of course, but often you're allowed
           | to modify things as long as you return it to how it was
           | before when you leave. Obviously not quite as simple as that
           | always but I would guess in many placing temporarily
           | replacing a simple thermostat would fall under that.
        
           | bethekidyouwant wrote:
           | You just take the thermostat off the wall and put it in a
           | drawer and then you buy a new thermostat and put it on the
           | wall and then when you give the apartment back, you take the
           | old thermostat and you put it back on the wall
           | 
           | Also, if you read this far, are you German or something? you
           | can just do things. which OP seems to know. And even if the
           | landlord came and saw the apartment as long as the new
           | thermostat isn't neon orange, he isn't going to notice and
           | even if he somehow noticed you would just gaslight him and
           | say no that's how it's always been and how the hell is he
           | gonna escalate past that? And why would he if the new
           | thermostat is more expensive and has better features?
        
       | smelendez wrote:
       | I wonder what the ideal one-size fits all thermostat looks like.
       | 
       | The one in my apartment has a "feature" a lot of US thermostats
       | now have, where you set four ordered times called wake, leave,
       | return, and sleep and the temperature you want the space in each
       | interval. I know very few people who actually live in a household
       | where everyone wakes, leaves, returns, and sleeps on the same
       | schedule every day.
       | 
       | I work from home and personally just want to set a temperature
       | and have the space stay at that temperature indefinitely but this
       | system requires that I tap through and enter the desired
       | temperature four times, while confirming the four intervals.
       | 
       | I guess I'd be happier with a _more_ programmable thermostat that
       | I could set to behave like an old school dial thermostat.
        
         | Freak_NL wrote:
         | Isn't this pretty much what these thermostats already allow? I
         | have a new Honeywell Thermostat which basically does what the
         | twenty years old one it replaced does with a few added
         | conveniences in terms of UI. It has those
         | wake/leave/return/sleep instants for each weekday (but also
         | adds an optional second leave/return pair), and it has an
         | option to override the day programme to 'holiday', which is
         | essentially an eighth programmable weekday you can activate at
         | any time.
         | 
         | Your use case is possible with that. Just set the standard
         | program to 15degC, and activate the holiday set to whatever you
         | need whenever you want. Configure it to go to 15degC at some
         | sensible time in the evening, so it won't go on even if you
         | forget it.
        
           | meindnoch wrote:
           | 15 C is very cold. Are you American?
        
             | Freak_NL wrote:
             | 15degC would be the standard setting of 'no heating' (just
             | keep the house warm enough to avoid mould and such). The
             | 'holiday' programme would be 21degC or whatever is desired.
             | That would effectively turn the thermostat into one where
             | turn on the heating by putting it in 'holiday' mode, and
             | can turn it off by exiting that mode or just letting it
             | revert to 15degC after 23:00 or so.
        
         | xattt wrote:
         | My wife and I worked a six-week shift work schedule for a long
         | time. We got second-gen nest thermostats when they first came
         | out (2012) thinking they were neat.
         | 
         | Nope! The smart learning feature was the biggest pain in the
         | ass. You'd be sleeping during the day for a night shift, only
         | to find yourself freezing because it decided no one was home.
        
           | uptown wrote:
           | You can turn off the feature that changes temp based on
           | presence. Or disable dynamic scheduling altogether.
        
             | xattt wrote:
             | I ended up having to manually changing the schedule week-
             | to-week.
        
           | JoshTriplett wrote:
           | I like the Nest, but I absolutely turned off all the "smart"
           | features and just set a fixed temperature range and change it
           | when desired.
        
         | Cthulhu_ wrote:
         | I'm still of the opinion that a dial works best. Especially in
         | modern homes (in Europe at least), there seems to be a school
         | of thought that you should just leave your thermostat at the
         | same temperature at all times - the theory being that warming
         | up a cold house in the morning costs more energy than
         | maintaining a stable temperature.
         | 
         | Anyway, my ideal setup would be to install 'smart' thermostat
         | taps on every radiator in the house, either manually turn them
         | down when you're not in the room or have them automatically
         | detect activity or open windows and adjust accordingly. But
         | each one has the authority to trigger the central boiler if
         | needs be, instead of only the master thermostat in the living
         | room.
        
           | vladms wrote:
           | I think in real life there are more constraints. For example
           | there are people that sleep better at a lower temperature
           | than the daily one (so leaving the thermostat at the same
           | temperature it's a minus for them).
           | 
           | Regarding "what is better" from energy efficiency, I would
           | prefer a system that "check it" because my guess is that it
           | depends a lot based on the individual situation. I mean
           | everybody is going crazy over "IA" but a couple of sensors
           | and a system smart enough to adjust your usage based on your
           | particular situation and preferences (like "eco", etc.) is an
           | exception.
        
             | alistairSH wrote:
             | In slightly cooler climates, the answer for sleep is to
             | open windows. This works in much of Europe, even through
             | summer.
             | 
             | But of course, not really feasible in Atlanta or Phoenix.
             | Nighttime temps are too warm.
        
               | deno wrote:
               | Open windows in a city often means you are invinting in
               | pollution, both air and noise.
        
               | JoshTriplett wrote:
               | Exactly. Current HVAC systems have extensive filtration;
               | some HVAC systems have HEPA filters.
        
               | eru wrote:
               | We are talking about places that need heating here.
               | 
               | In general, you should either run the heater or have your
               | window open. Both at the same time is bad news for your
               | energy bill.
        
           | miunau wrote:
           | We've used the Tado system with a central boiler and smart
           | radiator knobs for a few years. It's worked fine and hooks up
           | to Home Assistant and can do the things you describe. I'm
           | sure there are some alternatives.
        
           | wickedsight wrote:
           | > the theory being that warming up a cold house in the
           | morning costs more energy than maintaining a stable
           | temperature
           | 
           | I've heard this theory a lot too, but it doesn't match with
           | physics. A warm house loses more energy than a cold house,
           | due to a higher temperature difference allowing easier heat
           | transfer. So in most homes, with radiators and high
           | temperature CV, it's way more efficient to just turn it off
           | when you gone.
           | 
           | One exception is when you have a very well insulated house,
           | combined with floor heating and a very efficient, low
           | temperature heat pump. In this case, it takes a lot of time
           | for temperature to move in the house and it's already
           | incredibly efficient.
        
             | sz4kerto wrote:
             | It does match physics if you consider other factors. Apart
             | from the heat pump scenario, this statement can also be
             | true when you have condensing boilers (and okay-ish
             | insulation)
             | 
             | The reasoning: when you heat up the house, then your boiler
             | needs to produce constant high-temperature water. When you
             | keep the house at the same temperature, then the boiler
             | produces much lower temp water and it is more efficient.
             | 
             | Insulation also matters because if your house has outer
             | insulation then it means that heat transfer from the house
             | to the environment is mostly blocked, but cross-room heat
             | transfer is likely not (through the walls). Therefore it is
             | better to heat the whole house than heating just a couple
             | of rooms because if you do the latter then you'll end up
             | heating the whole house anyway but you're using less
             | surface area (meaning you need higher flow temperatures,
             | meaning less efficiency).
        
               | eru wrote:
               | > The reasoning: when you heat up the house, then your
               | boiler needs to produce constant high-temperature water.
               | When you keep the house at the same temperature, then the
               | boiler produces much lower temp water and it is more
               | efficient.
               | 
               | How does your boiler produce heat for your water in your
               | scenario?
               | 
               | > Therefore it is better to heat the whole house than
               | heating just a couple of rooms because if you do the
               | latter then you'll end up heating the whole house anyway
               | but you're using less surface area (meaning you need
               | higher flow temperatures, meaning less efficiency).
               | 
               | Just model the other rooms as very weird wall to the
               | outside.
        
           | tgsovlerkhgsel wrote:
           | > the theory being that warming up a cold house in the
           | morning costs more energy than maintaining a stable
           | temperature
           | 
           | This is only true if the heating happens quickly _and_ the
           | system is less efficient when heating quickly. Otherwise,
           | this doesn 't make sense from a physics standpoint. A
           | temporarily lower temperature differential means less kWh of
           | heat lost.
        
             | DamonHD wrote:
             | This is a whole research topic, my PhD in fact!
             | 
             | FWIW I run my heat pump intermittently and with locally-
             | smart TRVs that get to call for heat centrally, and a
             | weather compensation only flow temperature curve, and it
             | WORKSFORME!
             | 
             | https://www.earth.org.uk/heat-pump-16WW-control.html
        
               | anotherhue wrote:
               | I enjoyed reading this, thank you.
        
               | DamonHD wrote:
               | \o/
        
             | rightbyte wrote:
             | "Quickly" implies higher power which will make the air
             | around radiators warmer than a slow heating.
             | 
             | The losses are proportional to the temperature differential
             | between outside and inside.
             | 
             | So you should have somewhat higher losses from the hotter
             | air streams from the radiators passing the windows.
             | 
             | Dunno about magnitude though.
        
             | adrianN wrote:
             | Heating systems generally are more efficient when they need
             | to output less power. Whether that cancels the increased
             | heat loss seems to be a question that can't be answered in
             | general.
        
             | jmilloy wrote:
             | I think that maintaining a stable temperature means warm
             | walls/floors/furniture and potentially cooler air
             | temperature, as opposed to a cold house with intermittently
             | warm air. Most people can feel comfortable at a lower
             | thermostat (air) temperature if the walls etc are warm due
             | to maintaining a stable temperature. I don't have
             | calculations or references, YMMV.
        
             | Suppafly wrote:
             | >Otherwise, this doesn't make sense from a physics
             | standpoint. A temporarily lower temperature differential
             | means less kWh of heat lost.
             | 
             | This topic comes up anytime thermostats and heating are
             | mentioned. The physics arguments only makes sense if you
             | don't care about comfort. Most people would rather optimize
             | for comfort with some energy/cost savings if possible and
             | the physics folks seem to not care about comfort at all.
        
           | KineticLensman wrote:
           | (UK) my boiler has a control with something like the
           | wake..leave timer (it actually has six settings for a midday
           | period as well) and there is a separate thermostat with a
           | temperature dial. The boiler also has a button that advances
           | it to the next time interval if you want instant on (eg if
           | you come home early to a cold house). I find this combo of
           | controls meets all of my needs, given that I have a fairly
           | repeatable daily schedule.
        
           | eloisant wrote:
           | > the theory being that warming up a cold house in the
           | morning costs more energy than maintaining a stable
           | temperature.
           | 
           | That's true if you completely stop heating. However if you
           | lower the temperature by roughly 3.5C when you're not home,
           | you'll be saving energy.
           | 
           | So you can for example program it to be 16C when you're out
           | and 19C when you're in. You don't completely turn off heating
           | indeed.
        
         | tgsovlerkhgsel wrote:
         | The obvious solution is a "wake time" of 8 am, "leave time" of
         | 8:01, "return" 8:02, "sleep" 8:03. Then just set the sleep
         | temperature to your desired temp and the remaining ones to
         | something reasonably close, or if it doesn't automatically
         | switch between heating and air conditioning, set it for the no-
         | op for the season (i.e. the highest possible temp in summer,
         | and the lowest possible in winter) for those three minutes.
        
         | bob1029 wrote:
         | > I wonder what the ideal one-size fits all thermostat looks
         | like
         | 
         | https://www.honeywellhome.com/us/en/products/air/thermostats...
        
         | ThePowerOfFuet wrote:
         | > I wonder what the ideal one-size fits all thermostat looks
         | like.
         | 
         | As you go on to describe, there probably isn't one.
        
         | 542354234235 wrote:
         | I have an Ecobee and I like it. It comes standard with Home,
         | Away, and Sleep but you can put in as many or as few as you
         | want. You can manually change the temp and you can also set how
         | long you want your manual temp to "stick". Either until you
         | cancel it, or until the next preprogrammed change. I like it
         | cooler at night, so I have it change temp around my normal
         | bedtime, which includes if I adjusted the daytime temp because
         | I don't want to have to remember to change it back myself,
         | that's why I have a smart thermostat. It detects when I leave
         | the house and sets it to away, because I don't need it running
         | as if I am at home. If I go on vacation I can set it to keep
         | the house safe, but not comfortable, and change back around the
         | time my flight lands.
         | 
         | Unless you have a crazy random schedule, or you want the temp
         | the same whether you are asleep, awake, or not at home, or i
         | guess if you have different temp preferences every day.
         | Otherwise you can program in a basic schedule and just adjust
         | manually as needed. Nothing stops you from changing the temp
         | manually if you wake up an hour early, but if you wake up on
         | time, then you don't even have to think about it.
        
         | quickthrowman wrote:
         | > ideal one-size fits all thermostat
         | 
         | The round Honeywell electromechanical thermostat with a
         | bimetallic strip, invented in 1953:
         | https://www.honeywellstore.com/store/products/honeywell-roun...
         | 
         | 24VAC, dead simple, and reliable. My family's lake house has
         | 50+ year old Honeywell round thermostats still in service.
        
         | Suppafly wrote:
         | >I guess I'd be happier with a more programmable thermostat
         | that I could set to behave like an old school dial thermostat.
         | 
         | I honestly prefer the older type. Ours is programable, but we
         | just don't program it and always just set it to the temp we
         | want. If we are feeling a little chilly on a cold day, we'll
         | bump it up a degree, or down a degree when it's particularly
         | sunny and everyone is feeling warm.
        
       | YakBizzarro wrote:
       | Funny how the manufacturer proudly claims that the protocol is
       | encrypted, but completely forget to mitigate replay attacks,thus
       | making the encryption completely useless
        
         | kleiba wrote:
         | Which raises the question whether the OP now unknowingly also
         | controls the heater in the apartment next to his...
        
           | mattigames wrote:
           | And so the heat-stroke-killer was born, offing his victims
           | with rapid changes between coldest and hottest setting,
           | natural death has never been this human-made.
        
           | simooooo wrote:
           | Probably not otherwise the original would also potentially
           | run that risk
        
             | kleiba wrote:
             | Good point!
        
           | mhw wrote:
           | Unlikely. This kind of wireless thermostat has two parts: the
           | thermostat itself, and a separate receiver box that's
           | directly connected to the boiler. There's usually a pairing
           | process that you can go through where the two parts negotiate
           | a shared value used in the protocol; this prevents one
           | thermostat unintentionally controlling other boilers. You can
           | see this described in the Installation Guide for the
           | thermostat linked from the article (it's called 'binding' in
           | the guide).
        
           | videah wrote:
           | The thermostats are paired, if my setup was able to control
           | another apartments boiler then the original thermostat would
           | also do that
        
         | globular-toast wrote:
         | Ah yes, the classic problem of people using crypto primitives
         | without fully understanding the problems they're trying to
         | solve. Anyone even remotely interested should look into a full
         | protocol like TLS or PGP to see how many primitives like block
         | ciphers, hashes, etc. are involved and why.
        
       | badmonster wrote:
       | loved the blend of reverse engineering and persistence
        
       | __turbobrew__ wrote:
       | The legit Hackrf One is known to have frequency smearing, I
       | wouldn't use one off Aliexpress to transmit without testing it
       | with a spectrum analyzer first (which you probably don't have if
       | you are buying knockoffs from Aliexpress).
        
         | KeplerBoy wrote:
         | What does frequency smearing mean in this context?
        
           | tgsovlerkhgsel wrote:
           | You're trying to transmit (only) on e.g. 433 MHz, but you
           | actually transmit on 433 MHz and a bell curve around it.
        
             | KeplerBoy wrote:
             | so, severe LO clock drift?
        
               | __turbobrew__ wrote:
               | Not exactly, the transmitted power tends to be centered
               | on the frequency you desire, but there are unwanted
               | harmonics off the center frequency. Its like having a
               | fire hose that hits the desired target with water
               | (something on fire), but it also hits everything else
               | around the target in a large radius as well which may be
               | very sensitive to water (precious art, high power
               | transformers, etc)
        
         | tgsovlerkhgsel wrote:
         | The blogpost mentions "I guess it's always good to have another
         | SDR just to confirm that we're not polluting other
         | frequencies." and they have an RTLSDR which probably could
         | serve as a good enough spectrum analyzer for this use case?
        
       | solarist wrote:
       | One doesn't actually need any extra hardware for this... just 8cm
       | of wire and this https://github.com/F5OEO/rpitx
       | 
       | (use at your own risk of course)
        
         | LeonM wrote:
         | From the linked repo:
         | 
         | > rpitx is a general radio frequency transmitter for Raspberry
         | Pi which doesn't require any other hardware unless filter to
         | avoid intererence. It can handle frequencies from 5 KHz up to
         | 1500 MHz.
         | 
         | Wait, how does that work?
         | 
         | 1.5GHz is a _lot_, I can't imagine this is done with bit-
         | banging an I/O line, nor do I expect the Pi will have a DAC
         | with anything close to a 3GHz+ sample rate.
         | 
         | > Plug a wire on GPIO 4, means Pin 7 of the GPIO header (header
         | P1). This acts as the antenna.
         | 
         | A bit of Googling shows me that on the later Pi board GPIO4
         | (pin 7) has a bunch of alternative modes, amongst which is a
         | general purpose clock output (GPCLK0), a DPI output bit
         | (DPI_D0) and what I recon is composite analog video in/out
         | (AVEOUT_VID0, AVEIN_VID0), and the TDI JTAG pin. But none of
         | these would get close to 1.5Ghz TRX capabilities, no?
         | 
         | What's the magic here?
        
           | solarist wrote:
           | RF is basically black magic but here it's the harmonics of
           | lower frequencies that are in GHz range (and very noisy and
           | weak)
        
         | videah wrote:
         | This did come up when I was researching this but it's
         | incredibly dangerous as you'll be spewing all over the spectrum
         | due to harmonics, I considered it too much of a hack for my
         | liking
        
       | Mond_ wrote:
       | Cool as fuc + very nice blog design.
        
         | pyfon wrote:
         | Furry cartoons are catching on.
        
       | buccal wrote:
       | Cool project.
       | 
       | Speaking of newish natural gas (CH4) heaters, they all should
       | have modulating thermostat capability with OpenTherm/eBus or
       | other protocol. Combined with a thermostat with outdoor
       | temperature sensor system efficiency is increased a few percent
       | and that should help offset thermostat and installation costs. In
       | the end you have more efficient modern heating system.
       | 
       | Same should apply for heat pump systems.
        
         | steelegbr wrote:
         | OpenTherm is a cool idea but even new installations aren't
         | always wired for it. When installing a new smart thermostat I
         | found the installation has been wired as S Plan with the few
         | cables running between the boiler location and valves location
         | already consumed. Makes the job much bigger if you're not
         | prepared for it.
        
           | buccal wrote:
           | There are many wireless OpenTherm thermostats. Wired is
           | better but is not required for modern thermostats.
        
       | alistairSH wrote:
       | Is this a non-standard thermostat control mechanism? I don't know
       | what's common in apartments. All my houses have the thermostat
       | wired to the HVAC (and are easily replaceable by the resident).
        
       | sokoloff wrote:
       | > I also have it so the heating turns off when I go into town and
       | turns back on when I'm just a few train stops away so my place is
       | nice and toasty for me getting home!
       | 
       | If your goal is saving energy/money, you _don't want_ a system
       | capable of going from cool to toasty in 20 minutes.
       | 
       | Instead, you want a system that runs (much) lower water
       | circulation temperatures (giving lower losses in the
       | unconditioned spaces and more even room heating). That can be
       | done to any condensing boiler by just turning down the flow
       | target temperature.
       | 
       | A second layer of optimization on top of this is the addition of
       | outdoor reset/weather compensation which will adjust that flow
       | temperature based on the outside temperature, giving a flow
       | temperature than can _just barely_ restore the building to the
       | desired setpoint temp.
       | 
       | With mine properly tuned, I was targeting having the thermostat
       | act more like a high-limit and for it to call for heat between 22
       | and 24 hours per day while not overheating the house. That often
       | meant flow temps in the 110degF (warm day) to 135degF (below
       | freezing day) range. Compared to the prior winter (at a constant
       | 160degF flow), the house used 8-15% less gas and was wildly more
       | comfortable. (This setup does preclude using deep setback
       | settings, which also can save money, because recovery times are
       | necessarily long in such a scheme, unless you have an even
       | smarter control system that can run perfectly tuned water most
       | times but hotter water during recovery from setbacks.)
        
         | frereubu wrote:
         | I've read that it's always more efficient to turn heating off
         | when you're not home and then turn it back on when you return.
         | Is the reason for it being on 22-24 hours here that it takes a
         | very long time to get back to the desired temperature, meaning
         | you'd actually be cold for quite a while as it returned to the
         | desired temperature?
        
           | sokoloff wrote:
           | I work entirely remote so, other than travel, there are not
           | many long periods when the house is unoccupied.
           | 
           | I target the long run time to maximize efficiency. A 160degF
           | pipe will lose more heat to the part of the building that I
           | don't want to heat as well as more heat to the wall right
           | behind the radiators. It also results in the house going
           | micro too-hot, too-cold, too-hot, too-cold as it cycles. Mine
           | is constantly trickling in just enough heat to replace the
           | heat lost instead of cycling between adding way more than
           | needed then none for a while.
           | 
           | Another large effect is that low return water temperatures
           | into the boiler allow for greater condensation of exhaust gas
           | energy to be used in the building instead of sent outside.
           | Walking by my house on a cold day, you'll see minimal steam
           | plume during operation. All that steam I see my neighbors
           | emitting is energy they paid for and delivered to the
           | outside... (They paid a lot for a boiler with a 95% or 98%
           | sticker and run it at 80% efficiency.)
           | 
           | https://kw-engineering.com/how-to-optimize-condensing-
           | boiler...
        
             | Retric wrote:
             | > A 160degF pipe will lose more heat to the part of the
             | building that I don't want to heat as well as more heat to
             | the wall right behind the radiators.
             | 
             | You've got the first part of that backwards, it's the walls
             | near your radiators that are your problem and need more
             | insulation.
        
               | sokoloff wrote:
               | Indeed the building is 100 years old and impractical to
               | retrofit insulation in any cost-efficient way (structural
               | brick, lathe and plaster walls with about 1" of air space
               | in the original parts of the building).
        
             | frereubu wrote:
             | Thanks for the explanation.
        
             | eru wrote:
             | Btw, a heated blanket would be a lot more efficient, as it
             | warms just your butt.
        
               | sevensor wrote:
               | Heated blankets are ok, but you have to arrange them just
               | so, and then you can't move without fussing with the
               | cord. It's the last resort after layering warm clothes
               | before bumping up the thermostat.
        
               | pests wrote:
               | I use a heated blanket as a bottom layer sometimes. Lets
               | you move around and do whatever you want with the blanket
               | fixed in place and the cord not in the way. I have larger
               | heated blanket that has independent power/settings for
               | each half. I turn one half on max and leave the other off
               | and can roll and find the perfect direct heat and if
               | using another regular blanket on top all that is captured
               | too.
        
             | amluto wrote:
             | > Another large effect is that low return water
             | temperatures into the boiler allow for greater condensation
             | of exhaust gas energy to be used in the building instead of
             | sent outside.
             | 
             | Correct.
             | 
             | > Walking by my house on a cold day, you'll see minimal
             | steam plume during operation. All that steam I see my
             | neighbors emitting is energy they paid for and delivered to
             | the outside... (They paid a lot for a boiler with a 95% or
             | 98% sticker and run it at 80% efficiency.)
             | 
             | Please check your assumptions.
             | 
             | A boiler operating in condensing mode will produce a
             | trickle of liquid condensate (that may well be drained
             | somewhere that you can't see [0]), teeny tiny drops of
             | condensate suspended in gas (colloquially "steam", but it's
             | more like fog), and some residual water vapor mixed with
             | the exhaust gasses. You can see the "steam", but you cannot
             | see that residual vapor except to the extent that it
             | condenses further as the exhaust stream cools after it
             | exits, much as you can see some of your own exhaled water
             | vapor on a cold day as it condenses outside your nose or
             | mouth. The exhaust gas is saturated: it has maximum
             | humidity and is at its own dewpoint, so there is a lot of
             | visible fog. The droplets that form inside the boiler and
             | escape with the flue gas do not represent wasted heat:
             | their heat of fusion has been captured.
             | 
             | A boiler operating in non-condensing mode will produce no
             | liquid condensate, and its exhaust will be well above its
             | own dewpoint. It will contain far more water vapor than a
             | condensing boiler, but _you cannot see that vapor_ except
             | insofar as the flue gas has a different index of refraction
             | than the surrounding air and distorts the background a bit.
             | Depending on weather, a bit of it may condense later. All
             | of it is wasted energy.
             | 
             | [0] This liquid condensate is nasty stuff: it's basically
             | carbonated distilled water plus some impurities but not
             | usefully buffered, and it's rather acidic. It will quickly
             | corrode many metals, including copper and many common
             | copper alloys, non-stainless steel, galvanized steel, etc.
             | Non-condensing furnaces and boilers are generally carefully
             | engineered to avoid condensation, because the condensation
             | would damage them. If your plumber is unaware of the degree
             | to which boiler condensate is corrosive and uses copper
             | pipes or metallic fittings (push-to-fit in the style
             | commonly sold as "Sharkbite"), the system will fail. Use
             | plastic pipes (PVC or PEX) and _plastic_ (or maybe
             | stainless steel) fittings such as ordinary solvent-cement
             | PVC fittings, "engineered plastic" PEX fittings, or push-
             | to-connect fittings with _plastic_ wetted surfaces. John
             | Guest makes these, and there is also the somewhat bizarre
             | ProLock brand, which seems to be some sort of joint
             | offering from John Guest and Sharkbite.
        
               | sokoloff wrote:
               | I'm imagining that what I see in my neighbor's exhaust is
               | the subsequent condensation as their exhaust gas cools to
               | where the dew point is met and visible moisture becomes
               | apparent.
               | 
               | I can see a clear difference between running my own
               | boiler at 25degF OAT (lots of "steam") versus 40degF OAT
               | (almost none) while I see my cross-street neighbor
               | showing large plumes on both. I'm not sure if I mistyped
               | above or I'm actually thinking about it wrong, but I
               | don't think my observations are incorrect.
               | 
               | Having that water condense outside the building (giving
               | up heat to the neighborhood) is less efficient than
               | having that water give up its heat into the incoming
               | (return) water.
        
           | leoedin wrote:
           | The hidden factor here is that condensing boilers and heat
           | pumps have non-linear efficiency vs flow temperature curves.
           | Heat pumps in particular show high increase in coefficient of
           | performance (CoP) as flow temperature drops.
           | 
           | The other variable is how well controlled your heating is. A
           | lower flow temperature means less overshoot of the target set
           | point - and as losses scale linearly with temperature delta,
           | that can mean higher energy losses (depending on the
           | characteristics of the controller of course).
           | 
           | Whether or not you care about losses in unheated spaces
           | depends on your system topology. Personally, all my heating
           | pipes are within the thermal envelope of my house, so flow
           | temperature has no bearing on those losses at all.
           | 
           | If you had a resistive electric boiler, flow temperature
           | would have absolutely no effect on efficiency. You'd be
           | completely right, that running heating only when you needed
           | it would be more energy efficient.
        
             | frereubu wrote:
             | Thanks for the explanation.
        
             | looofooo0 wrote:
             | You missing ISO7730, it is a system for humans and not air
             | temperature control. (tl;dr heating your home 24/7 allows
             | you to lower air temperature for the same comfort. )
        
           | rsynnott wrote:
           | > I've read that it's always more efficient to turn heating
           | off when you're not home and then turn it back on when you
           | return.
           | 
           | 50 years ago this was _always_ the case, but condensing
           | boilers and especially heat pumps muddy the waters a little.
           | Condensing boilers can be close to 100% efficient (vs ~70-80%
           | for ye olde gas boilers), but generally only at a fairly
           | specific operating temperature, which may be lower than you'd
           | need to get a rapid rise in temperature. Heatpumps are >100%
           | efficient (that is for every joule of electricity you put in
           | they move more than one joule), but are even more fussy about
           | operating temperature.
           | 
           | The answer now is going to be a solid 'it depends', based on
           | behaviour of the heating system, outside temp, desired inside
           | temp, insulation...
        
             | looofooo0 wrote:
             | ISO 7730 to the help. Just keep low overall temperatures
             | and heat 24/7 in a reasonably insulated home.
        
         | Retric wrote:
         | That's an artifact of how heating is setup inside your home.
         | Which is more efficient depends on where you're dumping heat
         | inside the home, levels of insulation, etc.
         | 
         | Energy moves from hot to cold linearly with temperature
         | differences. Hypothetically, if the pipe was the same
         | temperatures as the inside of your home all the heat
         | transferred would be outside the envelope. The hotter the pipe
         | the better this ratio becomes. This is true regardless of what
         | percentage of the pipe is inside the envelope.
         | 
         | However, heating along the exterior of the home under windows
         | and such then you'll heat the exterior walls to higher
         | temperatures than the interior thermostat thus losing more heat
         | to the outside. Radiant heating on the other hand largely
         | avoids this effect.
        
           | DamonHD wrote:
           | I moved all my radiators away from under windows (and
           | upgraded the windows to triple glazing) to avoid maximising
           | the temperature differential and energy loss through the wall
           | under the windows, while eliminating the cool drafts that the
           | under-window radiator placement was intended to counter.
        
             | HPsquared wrote:
             | What do you do for ventilation?
        
               | DamonHD wrote:
               | The windows all still open, but in winter we have
               | (nearly) enough MHRV (Mechanical Heat Recovery
               | Ventilation) not to need to ventilate directly, eg see:
               | 
               | https://www.earth.org.uk/MHRV-mechanical-heat-recovery-
               | venti...
        
             | sudahtigabulan wrote:
             | Do you mean you moved them to another wall, or just
             | increased the gap?
             | 
             | (not a native speaker here)
        
               | DamonHD wrote:
               | Moved them to another wall.
               | 
               | Eg: https://www.earth.org.uk/note-on-superinsulating-
               | bedroom.htm...
        
             | Benanov wrote:
             | Radiators were originally designed to heat more than
             | needed, so you could open the windows.
             | 
             | In New York, at least - the standards were never changed to
             | accomodate for closed windows in 1920. Snopes has a
             | rundown. https://www.snopes.com/fact-check/apartment-
             | radiator-pandemi...
        
               | organsnyder wrote:
               | My house (built in 1916) was insanely over-provisioned.
               | When we upgraded to a modulating-condensing boiler, we
               | halved the BTUs and are still able to easily keep the
               | house heated to any desired temperature even on the
               | coldest winter days.
        
             | DamonHD wrote:
             | I'm really confused about (not complaining, just not
             | understanding) the downvotes.
             | 
             | These are statements of neutral fact, and the whole process
             | is described in some detail on my site, for each room that
             | we retrofitted.
             | 
             | I don't understand if I have caused offense or something:
             | apologies if somehow so!
        
               | joncrocks wrote:
               | I'm not sure, but I think that the reason that radiators
               | are placed near windows (at least historically) was to
               | avoid hot/cold spots in rooms.
               | 
               | By placing the radiator near the place that is likely the
               | coldest place in the room, you ensure that the room is an
               | even in temperature as possible. Rather than to
               | counteract 'cool draughts'. I think.
               | 
               | So perhaps people thought that your initial comment was
               | wrong/misleading.
               | 
               | But if you have triple glazing and this mitigates the
               | heat loss, then the coldest wall of your room may no
               | longer be the one with a window, so you may well be doing
               | the right thing for your room(s).
        
               | DamonHD wrote:
               | Even if the coldest wall is still the exterior one (it
               | should be, thermodynamically), best maintaining comfort
               | in the room need no longer be by pumping heat out through
               | that wall (or window) to reduce thermal gradients in the
               | rest of the room. Those residual gradients (and, eg, cold
               | drafts down those cooler exterior walls) can be small
               | enough to not need fixing any more.
        
           | looofooo0 wrote:
           | Look at ISO 7730, a lot of comfort comes from non-cold walls
           | and their radiant heat and small difference of wall
           | temperatures to air temperatures. So having a thoroughly
           | heated home allows you to lower your air temperature. Apart
           | from that modern gas and even more heat pumps greatly gain
           | efficiency by lowering flow water temperatures.
        
             | Retric wrote:
             | It's a deep rabbit hole as condensation, humidity, etc also
             | enter the picture. Efficiently lowering temperatures for
             | sleeping further complicates things.
             | 
             | That said, heat loss is through exterior surfaces so you
             | really want to avoid spot heating of poorly insulated
             | exterior walls. Thus the design of baseboard heaters can
             | make a larger impact than you'd think.
        
               | looofooo0 wrote:
               | Baseboard heaters need very high temperatures. I would
               | not recommend installing this anywhere. Having big Typ 33
               | heaters for temperatures below 45degC will greatly
               | increase efficiency of your heating system. Otherwise, a
               | split air con is also an efficient way of heating.
        
               | sokoloff wrote:
               | Baseboard heaters are often sized such that very high
               | temps are needed (because that's what cheapest/lowest
               | labor/least space used), but they don't have to be sized
               | that way. In the attic bedroom, we have baseboards around
               | the entire perimeter on two walls and same in the bath. I
               | run the attic zone on the same water temp (outdoor reset
               | controlled to be quite low) as the rest of the house
               | (mostly large cast iron rads, one cast iron convector).
               | Good insulation and air sealing in the attic means that
               | the attic zone calls way less than the downstairs.
        
               | looofooo0 wrote:
               | Which is not exactly efficient. 40C or less is desirable.
        
               | sokoloff wrote:
               | My return water temps are 115F (46C) on a P98 design
               | heating day, and obviously cooler on warmer than design
               | days. Cooler is always better, but "baseboards require
               | 180F [82C] water because that's what's on the spec sheet"
               | is a commonly-held but mistaken belief.
        
               | looofooo0 wrote:
               | This is bad. Return water should be less 35 degree max.
               | Actually 30 degree after the heat pump would be ideal:
               | https://www.flow30.de/
        
               | jillyboel wrote:
               | [citation needed]
        
               | looofooo0 wrote:
               | Ah this is school knowledge of thermodynamics: the
               | smaller the delta the more efficient the heat pump. For
               | human comfort look at the iso7730. Also the system is
               | self regulatory with such low temps.
        
             | aesh2Xa1 wrote:
             | Having read that document, the ISO 7730 model itself
             | depends on stable temperatures. However, I think the key is
             | simply to understand thermal mass; people can be in hotter
             | air, but feel cold due to cold surfaces (e.g., floors or
             | furniture), which heat more slowly (or lose heat more
             | slowly) than the air itself.
             | 
             | Therefore, 1st: Heating/cooling cycles from your HVAC are
             | fighting these objects because they don't mix at the same
             | speed as other objects (e.g., the air itself), so you end
             | up with gradients across objects; people rate this feels
             | unpleasant.
             | 
             | 2nd: Mechanical equipment tends to operate more efficiently
             | under constant load compared to constant start and stop
             | cycles.
             | 
             | With #1 and #2, you can just heat constantly to increase
             | both the uniformity of heating across objects and also the
             | efficiency of the mechanical equipment's energy conversion.
             | 
             | There's a 3rd point, which, really, is just a sneaky way of
             | reframing #1 and #2, and that is that you can also lower
             | your setpoint and still have a subjectively superior
             | comfort perception compared to a cyclic system. It drives
             | home the point to say "constant 68F feels more comfortable
             | than intermittent 72F." But it also invites the complaint
             | about constant versus intermittent energy use, right? So I
             | think just detailing #1 and #2 is better.
        
               | looofooo0 wrote:
               | https://www.krantz.de/wp-content/uploads/2024/04/layout-
               | spec...
        
               | aesh2Xa1 wrote:
               | That spec aligns with my understanding, including the
               | model's dependence on comfort perception. I was,
               | initially, in disbelief about it, but changed my mind
               | after reading thru. The texty reply was to make it more
               | palatable for someone like me to accept. I think we
               | agree.
               | 
               | One thing I missed in summary is the concept of general
               | radiant temperature gradient. It's not only about the
               | gradient for conduction, but for radiation (and
               | convection). So you could probably improve my summary by
               | talking about any gradient between different objects in
               | the environment and their EM, which feels unpleasant (but
               | I think it had value in its reduction of the problem,
               | too).
        
         | sz4kerto wrote:
         | > If your goal is saving energy/money, you don't want a system
         | capable of going from cool to toasty in 20 minutes.
         | 
         | Depends. As explained in a sibling comments, I have some rooms
         | that have combined UFH and radiators, and if the desired temp
         | is more than 1 celsius away from the current temp, then both
         | are driven, otherwise it's just the UFH.
        
           | sokoloff wrote:
           | Indeed "depends" is almost always the answer.
           | 
           | So long as you can get the boiler return water temps low
           | enough, you can operate the boiler in its high efficiency
           | range.
           | 
           | Most dual-temp setups are set for the highest temp and mixed-
           | down to provide the lower temp for under-floor. That's
           | cheapest in terms of equipment and install but cannot be as
           | efficient as a system that mixes down when both loads call
           | but also lowers flow temp (thereby lowering return temp) when
           | no high-temp rads are calling.
        
         | quickthrowman wrote:
         | This is a great post which describes how most commercial
         | boilers are controlled. I'm looking at a sequence of operations
         | for a boiler project I did recently and the hot water supply
         | setpoint for -20F outdoor air is 145F and for +45F the hot
         | water supply setpoint is 120F.
         | 
         | Most home boilers lack an outdoor air reference temp sensor but
         | all commercial boilers have them.
         | 
         | Also, condensing boilers are amazing, the size difference alone
         | vs an old tube boiler is wild, very small in comparison.
        
         | looofooo0 wrote:
         | Agree, switching on and off is the worst way of heating. If you
         | look into ISO 7730, then a lot of comfort comes from non cold
         | walls: https://de.wikipedia.org/wiki/ISO_7730 This means that
         | in a reasonable insulated home, your best bet for comfort is to
         | just keep the temperature constant and low like 20degC. This
         | also allows you to lower your water temperatures which improves
         | efficiency of your heat pump or boiler.
        
           | static_motion wrote:
           | Depending on the region, "reasonably insulated home" really
           | is the factor that makes this not so viable for a lot of
           | people. In my Mediterranean-adjacent climate country, most
           | homes are just not well insulated at all, and having heat
           | running 24/7 during winter is extremely costly and
           | inefficient even if the heating is on a low setting.
        
             | looofooo0 wrote:
             | These home will most likely have a split air con, which
             | will be the most efficient way of heating them. Also there
             | is so much other room for improvement like drafty windows
             | and doors etc.
        
               | walrus01 wrote:
               | In many warmer climates, the mini split air conditioners
               | sold are cooling capability only. This is much cheaper to
               | purchase for a 12,000 up to 24,000 btu/h unit than one
               | which is also capable of heating the interior.
        
               | looofooo0 wrote:
               | Not true, I can buy a Chinese 4kw Model for 650EUR which
               | can heat till -15degree. Doubt that you can save much.
        
               | walrus01 wrote:
               | Go price air conditioners in the uae or Kuwait or
               | similar, the cooling only models are very much a thing
               | that exists on the market.
        
           | Syzygies wrote:
           | Yes!
           | 
           | I used to divide my time between a concrete hulk of a NYC
           | apartment building, and a California home insulated to
           | notoriously poor California standards. I was plenty warm in
           | New York winters just from my neighbors' heat nearly all of
           | the time. In California, there was a narrow window (think
           | "Apollo 13 re-entry") between too cold and too warm.
           | 
           | Then we modernized ceiling fans, and I hit on running them in
           | "winter mode" drawing hot air up to flow back down the walls.
           | Bingo! I love that ISO 7730 confirms this.
        
         | dheera wrote:
         | Capable doesn't mean it always puts out that amount of heat.
         | 
         | A well-designed system would have good insulation, can dump
         | 10000W watts of heat out and bring the room from cool to toasty
         | in 5 minutes, and then scale back and maintain the temperature
         | after that by putting out 500W after that.
         | 
         | This also tends to be more efficient in practice because if you
         | _know_ it only takes 5 minutes to heat up you are less likely
         | to want to leave it on when you 're not around.
        
           | organsnyder wrote:
           | But it can't heat up the walls and other surfaces in that
           | amount of time. The building will feel colder for the same
           | air temperature setting until those objects have had time to
           | warm up as well.
        
       | DecoPerson wrote:
       | The Flipper Zero is great, and could handle all of the
       | hacking/investigation part by installing custom firmware.
       | 
       | The original product understandably arrives with heavily-
       | restricted firmware (I imagine to reduce the amount of flak the
       | company receives). However, it is incredibly easy to install
       | Flipper Unleashed or similar, which removes all said restrictions
       | and adds a lot of additional functionality.
       | 
       | Possessing the tools that could be used to commit a crime is not
       | necessarily a crime in and of itself! Just be careful with what
       | you do or, depending on what country you're in, you might find
       | some men in suits knocking at your door.
       | 
       | Personally, I wanted to replay "encrypted" 433MHz signals for my
       | own devices (electric gate, roller door, roller shutters, ...)
       | and this was disabled with the Flipper's region set to Australia.
        
         | 0xEF wrote:
         | > Possessing the tools that could be used to commit a crime is
         | not necessarily a crime in and of itself!
         | 
         | While I do agree 1000%, I also want people to be careful with
         | this thinking since I have gotten in some minor trouble in the
         | past. Always assume the authority questioning you can and will
         | create whatever narrative they wish, that it will be accepted,
         | and that your own reasoning will likely be used against you.
         | 
         | I will always encourage exploration and curiosity in tech, but
         | if we stick with the Flipper Zero example, there's a few things
         | one should keep in mind, regardless of the jurisdiction they're
         | in:
         | 
         | * Don't carry it around unless you intend to use it.
         | 
         | * Read all documentation before you start practicing, then
         | practice being subtle.
         | 
         | * Taking a note from my outdoorsy side, adopt the "leave no
         | trace" ethos.
         | 
         | * Pay attention to the effect your presence and actions have on
         | the environment and your target and how that might be
         | interpreted by an outside observer, then take action to
         | mitigate suspicion.
         | 
         | These apply to lots of devices, everything from your disposable
         | smartphone to a cheap RFID card copier from Temu.
         | 
         | Our eagerness sometimes gets the best of us, especially new-
         | comers, and we want to jump to the part where we can be like
         | the hackers we see in tv and video games. There's a reason
         | those guys are fictional characters. Innocuous actions or not,
         | the perception of the authority questioning you is all that
         | will matter, in the end.
        
           | crtasm wrote:
           | Or perhaps go for the opposite of subtle - in many places
           | it's quite normal to see people in hi-vis vests taking
           | readings etc.
        
             | butlike wrote:
             | The 'shade curve' as I call it, where one reaches a point
             | where their actions could be considered so shady, it's
             | automatically assumed it couldn't possibly be them.
             | 
             | Smoking pot in a dark parking lot with friends at night
             | gives more cover, but smoking pot walking down your city's
             | main street in the middle of the day gives you the cover of
             | just smoking an innocuous "rollie," like any other person
             | could be.
        
               | JoshTriplett wrote:
               | It's hard for anyone with a nose to mistake one for the
               | other.
               | 
               | (The underlying point is completely valid, though.
               | Audacity is a powerful thing.)
        
             | 0xEF wrote:
             | That's an excellent additional thing to consider and I'm a
             | bit mad that I neglected it since I have _accidentally been
             | that guy._
             | 
             | My job requires me to wear hi-vis (as well as other PPE)
             | and it is crazy how little security pays attention to me in
             | some of the very-big-name plants I visit, often with a
             | laptop bag full of flash drives and a bunch of other tools
             | that allow me to get into the machines.
             | 
             | Early in this part of my career, I found myself in a very
             | large plant for the first time, and my escort got pulled
             | away on some other task (I now expect this to happen since
             | it's such a common occurrence), leaving me to fix the
             | machine I was working on. The place was the size of a small
             | town, and I needed to use the restroom, but nobody was in
             | the vicinity to ask, so I did my best to follow the floor
             | markings and signs. Found it, but took a wrong turn coming
             | back and found myself in a completely different area. Since
             | I was new, I tried to find my way back without asking
             | anyone I saw because I did not want to look stupid, but
             | nobody stopped me, questioned me, etc.
             | 
             | Probably one of the best lessons in social engineering is
             | looking like you're supposed to be there.
        
               | aeturnum wrote:
               | One should not practice these things in actual high
               | security areas, but it can be fun to simply walk around a
               | strange place with a look of purpose and velocity. Not
               | making eye contact, perhaps on a phone. As long as you
               | won't get in trouble it's easy to practice the body
               | language of belonging and that skill can be really useful
               | even if you are not trying to use it for malicious
               | purposes (i.e. if you are actually supposed to be there,
               | the best thing for everyone is you look the part and
               | don't cause more worry than required).
        
               | johnwalkr wrote:
               | I used to do contracted engineering and maintenance work
               | in railyards, and in each facility would obtain (always
               | with permission from my recollection) a well-worn
               | supervisor vest and hard hat. They are usually color-
               | coded.
        
           | NoSalt wrote:
           | > _" Always assume the authority questioning you can and will
           | create whatever narrative they wish, that it will be
           | accepted, and that your own reasoning will likely be used
           | against you."_
           | 
           | And with that, I give you:
           | 
           | Don't Talk To the Police:
           | 
           | https://www.youtube.com/watch?v=d-7o9xYp7eE
        
       | sz4kerto wrote:
       | We've moved to an new apartment (house) and we had to do a full
       | renovation. It doesn't have modern insulation and I calculated
       | that for the time being the ROI on insulation isn't worth it.
       | It's a multi-floor semi-detached house and I wanted the best
       | comfort and the most economical heating possible.
       | 
       | In particular: stable and individually adjustable temperatures
       | for bedrooms and living rooms; underfloor heating in some rooms
       | (bedrooms), radiator-based heating in some others (living room),
       | and combined UFH+radiators in some others (where UFH might not be
       | enough during extreme colds).
       | 
       | I thought I can just pay someone some money and they'll set up
       | the controls for me. It must be a simple exercise, right?
       | 
       | I could not have been more wrong. After spending a few hours of
       | understanding the setups that "experts" have recommended, I
       | figured out edge cases where they would be either wasteful or
       | uncomfortable (meaning: unnecessary and inavoidable temperature
       | overshoots or undershoots, etc.). I had many-many rounds with
       | Honeywell, Tado, Siemens, etc. and every single one of them had
       | _major_ issues.
       | 
       | The renovation got a bit stuck because of this, but the plumbing
       | was ready so I wanted to see whether the pluming and pumps are
       | working, at least. So I connected the pumps and valves to "smart
       | plugs", i.e. Zigbee-controlled plugs, so that I can see that they
       | turn on. They did, which got me thinking...
       | 
       | Right now I have $20 Zigbee temp sensors sprinkled across the
       | house, $30 smart plugs and relays driving valves, pumps and the
       | boiler, and Home Assistant is controlling the whole thing.
       | Everything works perfectly and I could implement some features
       | that simply no system would have done out of the box, for example
       | in rooms where there's combined UFH and radiators I can drive
       | both heating systems when the target temperature is far from the
       | desired (so that the room heats up quickly) but as the room temp
       | is getting closer to the target, the radiators are turned off so
       | that UFH dominates heating (more comfortable and more energy
       | efficient than radiators). In rooms with radiators, temp is +-
       | 0.4 C within target, in rooms with UFH, it's +-0.1C within
       | target.
        
         | darkwater wrote:
         | Yeah, the automated/remote controlled heating system world, and
         | also the ringbell world is basically a giant scam, since they
         | are updates on world that also scammed you in the past. I cried
         | when I shelled out so much money for my Tado device, but even a
         | dumb bTicino device costed in the hundred of euros realm, and
         | it's just a sensor + a small LCD display and a designed-in-hell
         | menu system to program it. And the same happens in Ip-based
         | ringbells. A Doorbird will cost you hundreds of euros for what
         | is basically a webcam plus some nice metal casing and a shitty
         | software, but it competes with analog systems with optic cables
         | etc that cost basically the same or more.
        
         | rightbyte wrote:
         | Sounds like a nightmare for a future buyer to operate.
         | 
         | Some people are unlucky enough to buy homes where a machine
         | engineer designed the boiler setup and the boiler room have
         | enough valves and manometers to like operate the engine of
         | Titanic.
         | 
         | I guess programmers are the new sinners in this area nowadays.
        
           | evrimoztamur wrote:
           | The existing professional setup was also a nightmare, what
           | gives?
        
             | rightbyte wrote:
             | Well first of I am envious and I would want to do something
             | similar.
             | 
             | If I inherit a heating system I want it to be all
             | mechanical except maybe the control system for any heating
             | pump.
        
           | sz4kerto wrote:
           | If we ever sell this (which we don't plan to), I know what to
           | install (it'll be quite good, just not this perfect). I have
           | it in a cupboard (a Siemens Connected Home thermostat
           | system), the downside of that is that the combined
           | UFH+radiator rooms will be less comfortable.
           | 
           | (But still more comfortable than 99% of the houses I've been
           | in.)
           | 
           | I haven't mentioned in the parent comment but as a test I've
           | dismantled the HA system and installed the Siemens system and
           | it works well, just not 'perfectly'.
        
             | rightbyte wrote:
             | Sounds well thought out. Many seem to forget designing for
             | replacing.
             | 
             | In generall I think all these IoT systems will be a major
             | headache as they age.
             | 
             | My thermostats on the radiators are 45 year old by now.
             | That is kinda the expected service life we are used to.
        
         | sokoloff wrote:
         | For every John Siegenthaler and Dan Holohan, there are
         | thousands of mechanical engineers and tens of thousands of
         | plumbers who are happier to slap in a $20K 4-hour boiler
         | retrofit. There's not enough extra money in catering to the
         | 0.1% of homeowners who care about the details.
        
         | amne wrote:
         | a bit off-topic: Are you running a single boiler and if so, how
         | are you mixing UFH with radiators given there's a ~20 _C
         | difference between the recommended temps for the two?
         | 
         | My knowledge is that for UFH you run at temps between 40-50_C
         | and radiators run at 60-70*C.
        
           | sz4kerto wrote:
           | UFH has mixing valves, so it runs on 38 C and radiators run
           | on 55C. Single boiler.
        
         | cameronh90 wrote:
         | Off the shelf systems aren't only optimised solely for
         | efficiency. They're made to be simple enough that an installer
         | with half a day's training can do a few multiplications and
         | additions to set the parameters that'll give you a tolerable
         | percentage of optimal in the situations that equipment is
         | specified for -- while still being understandable by the next
         | guy. This nearly always means things are a bit oversized and
         | inefficient to account for the things that the simple models
         | are missing.
         | 
         | Almost everything in engineering is like this, not just
         | heating. It's pretty rare that something is fully optimised.
        
         | ajolly wrote:
         | I'd like more details on your home assistant setup as I'm
         | trying to optimize mine.
         | 
         | Btw, you can use $5 LYWSD03MMC thermometers with ble or zigbee.
        
         | KennyBlanken wrote:
         | > We've moved to an new apartment (house) and we had to do a
         | full renovation. It doesn't have modern insulation and I
         | calculated that for the time being the ROI on insulation isn't
         | worth it.
         | 
         | You calculated wrong, guaranteed. Most likely, you wildly
         | underestimated fuel/electricity costs.
         | 
         | > After spending a few hours of understanding the setups that
         | "experts" have recommended, I figured out edge cases where they
         | would be either wasteful or uncomfortable (meaning: unnecessary
         | and inavoidable temperature overshoots or undershoots, etc.).
         | 
         | Instead of thinking "the entire HVAC/heat industry are idiots
         | who can't do any of this right", maybe you should take a look
         | in the mirror and consider that your assumptions and/or
         | criteria are wrong.
         | 
         | For example: under/over shoots in a modern HVAC or heating
         | system will not cause any "waste" or discomfort. 1-2 degree F
         | in overshoot does not mean the space will lose appreciably more
         | heat than if it had perfectly regulated at the setpoint. You
         | also don't want a system that responds instantly. Let's say you
         | open the door to receive a package, and you're signing
         | paperwork, etc. You close the door. The air in the room is
         | substantially cooler.
         | 
         | Should the heat turn on?
         | 
         | I bet it does in your home...but the correct answer is no,
         | because the air will warm up rapidly from all the objects that
         | were at the temperature of the room. Thousand-plus square feet
         | worth of surface area...
        
         | quickthrowman wrote:
         | > I could not have been more wrong. After spending a few hours
         | of understanding the setups that "experts" have recommended, I
         | figured out edge cases where they would be either wasteful or
         | uncomfortable (meaning: unnecessary and inavoidable temperature
         | overshoots or undershoots, etc.). I had many-many rounds with
         | Honeywell, Tado, Siemens, etc. and every single one of them had
         | _major_ issues.
         | 
         | Temperature hysteresis is unavoidable with a conventional
         | thermostat, but you can reduce it with PID controllers. Most
         | commercial building automation systems use PID controllers
         | extensively.
         | 
         | My guess is that the residential options from Honeywell, JCI,
         | Siemens, Trane, Carrier, etc are focused more on one-size-fits-
         | all applications, whereas commercial BAS systems are more or
         | less bespoke designs for a specific building (using commodity
         | sensors and controllers). I work with all five of the
         | aforementioned companies on building automation projects, FWIW.
        
       | rsynnott wrote:
       | Some risk of collateral damage in the form of randomly
       | controlling other peoples' boilers if your transmitter turns out
       | to be more powerful than the one in the thermostat, tho...
        
         | frontlodjkgi wrote:
         | I imagine even encrypted messages could be replayed if the
         | protocol wasn't designed against it. It also doesen't say what
         | kind of encryption it uses, it could be a very weak in-house
         | "encryption", for all we know it could be only an unknown
         | encoding.
        
         | videah wrote:
         | The thermostat is paired with the boiler, the signals bundle
         | the unique ID's of each so this won't happen. Otherwise there
         | would be a risk the original thermostat would do the same.
        
       | robocat wrote:
       | > sledgehammer approach
       | 
       | A hammerier solution would be to control the temperature seen by
       | the thermostat (ignore the difficult RF protocol).
       | 
       | A heating element and a temperature reading could control the
       | heat seen by the thermostat.
       | 
       | I'm pretty sure you wouldn't need any cooling (Peltier or
       | whatever). Just a heater and ambient cooling! Set the thermostat
       | to a high temperature, and run the heater to make the measured
       | temperature hotter: when you don't want the heating to run.
       | 
       | That said, I think hacking the RF protocol is geekier and far
       | awesomer.
        
       | gRoberts84 wrote:
       | I went through various stages of this myself and got an Sonoff RF
       | Bridge, that allowed me to capture and replay RF via Home
       | Assistant. In the end though, it was always easier to use an off
       | the shelf solution, especially for boilers. OpenTherm with Tado
       | worked perfectly.
        
       | gcanyon wrote:
       | It's an awesome hack!
       | 
       | It seems like the easier hack would be to put a peltier
       | heater/cooler under the thermostat then control _that_ remotely
       | to assume control over what temperature the thermostat sees.
       | 
       | The link to the exact model of thermostat isn't working, so I
       | don't know how amenable its design is to this approach, but the
       | thermostats I've used are generally wall-mounted and putting a
       | heat/cool source under them wouldn't be too hard. You'd need to
       | make sure that you didn't send both the heat and cool into the
       | thermostat, but that's a simple positioning problem.
        
         | paulkrush wrote:
         | Cool idea! It's ironic that this is such an efficient use case
         | for device that is so inefficient.
        
         | catsma21 wrote:
         | yeah i put mine in the freezer
        
         | looofooo0 wrote:
         | Actually the best control system for such a boiler would be to
         | control the heating curve where heating water temperature is
         | fixed to the outside temperature. If you aim for the lowest
         | water temperatures possible, then the system will become quite
         | slow reacting. Then you only need to adjust the flow of water
         | to the individual rooms to fix varying temperature issue. But
         | this is long term manual optimization process which takes 1 to
         | 2 years to perfect.
        
       | gwbas1c wrote:
       | > The only thing I'm not happy with is needing to use a very
       | powerful and versatile radio like the HackRF for something as
       | simple as a boiler on/off switch. But I'd rather use something
       | overkill and have it work than spend ages trying to force smaller
       | radios to do my bidding.
       | 
       | All the apartments I lived in had basic thermostats; and I even
       | rewired and replaced one of them.
       | 
       | What was blocking Videah from buying an off-the-shelf thermostat?
        
         | simooooo wrote:
         | I've got a similar problem, and plan to replace the thermostat
         | with a Shelly relay which can be toggled by home assistant's
         | events based on the TRVs in each room.
         | 
         | Then the boiler is basically controlled by the relay.
        
       | aboardRat4 wrote:
       | In the former Soviet Union we just have central heating
       | 
       | The government maintains indoor temperature at 24 degrees from
       | October to May, and the water is heated at the power stations.
        
         | jobs_throwaway wrote:
         | Jesus that sounds miserable. Sleeping at 75F?!
        
       | MisterTea wrote:
       | Instead of attacking a radio controlled relay, the author should
       | have read up on how their heating system works. All they need is
       | a relay controlled by an internet connected thing to replace the
       | thermostat receiver. I could understand if the receiver was
       | locked away but the video clearly shows they have access to the
       | boiler.
        
         | wpietri wrote:
         | That leaves very visible evidence that things have been hacked.
         | Any time the landlord comes around you'd want to remove that.
         | And if there's some sort of infrastructure emergency (plumbing
         | problem, heat goes out, fire in the building) it could be very
         | challenging to get there and remove all traces before the
         | landlord is stomping around.
        
           | MisterTea wrote:
           | Why would you be that paranoid? What laws exist in the UK
           | where this is so illegal as to be that paranoid?
           | 
           | That's a level of paranoia I would never have. You can easily
           | conceal them in a way that is almost imperceptible.
        
       | epsilonaurigae wrote:
       | OP removed their comment section, but if you're here:
       | 
       | I haven't done this since 2014 but the google nest API used to
       | (hopefully still does?) let you see and or set the thermostats
       | status with curl commands.
       | 
       | My use case was to run one shell script that got my burglar
       | alarms status, and if it was "armed/away" to simply set my nest
       | thermostat as away, too.
       | 
       | But it can also be hooked up to a dummy load or a relay and just
       | used as an indoor temperature sensor.
       | 
       | And the curl commands OP is relying on can be tied in to indoor
       | and outdoor temperatures , such as scraping local weather with
       | curl/wget and based on that integer, turning the boiler to a
       | minimum when it's a certain temperature outside.
       | 
       | Or turning it completely off when it's warm outside.
       | 
       | I'm about to revisit this again just because I have an ancient
       | gas pig of a furnace that uses microvolt and is too cold when
       | it's cold outside, and too hot when it's warm outside.
       | 
       | So I need one thermostat in place to turn it on no matter what at
       | 40F, but then some conditional logic to kick that thing on and
       | off on different cycles based on outdoor temps. The whole systems
       | too crude to implement one off the shelf without adding a zone
       | controller, so I just want a Linux box at home to be the zone
       | controller....
       | 
       | where I differ is that I'm not sending an RF signal to the
       | boiler, I just have to close an NO contact to engage mine (and
       | I'm lazily going to use the nest for that.)
       | 
       | If anyone knows of a better thermostat that has its own API I can
       | set, read sensors, turn hvac on and off without using google/nest
       | account or having a dependency on the goodwill of their API
       | existing forever , I'll come back and glean any responses thanks
       | in advance.
       | 
       | As an afterthought, hm I can just attach temperature probes and a
       | GPIO for a relay and indoor/outdoor temps and do away with
       | google/nest altogether.... Thanks for jogging my brain a bit I
       | might do exactly that.
       | 
       | (The nest was cool , and educational, I guess, 12 years ago when
       | I didn't know how to really do anything but run and fire off curl
       | commands on someone else's hardware for temp sense and closing a
       | relay and I don't have anything bad to say about it as a starting
       | point.)
       | 
       | Where I was going with this , though, was that , you could use an
       | off the shelf nest , and run
       | 
       | 1) one command against API to get thermostat status (system
       | thinks it's on or off , even though it's factually not directly
       | controlling anything) and then based on that,
       | 
       | 2) another command to your RF board to transmit a matching
       | signal.
       | 
       | ...
       | 
       | (However you could also do the same with a temperature probe that
       | can be read on board or over WiFi , and then manage your
       | setpoints in the script and or by other means: eg scraping a
       | weather site for the local outdoor temp in your case where the
       | landlord probably wouldn't let you attach or connect an outdoor
       | probe.)
       | 
       | Bonus with the nest approach is you get a dial, can mount it on
       | anything , doesn't have to be the wall of your unit... and it
       | "sort of works" like a normal thermostat as well, as soon as the
       | shell script reconciles the two states manually.
       | 
       | Long winded rant but the original use case was an apartment where
       | the thermostat was proprietary and serialized data and I didn't
       | have any option to integrate a smart thermostat other than
       | turning it to its maximum set point and then using the nest with
       | a massive 220V/50A HVAC relay to just chunk the AC power line on
       | and off on demand.
        
       | josefritzishere wrote:
       | For a related hack... If your apartment building with a BACnet
       | system, it also relies on a set of commands for heating and
       | cooling. Assuming you are on the same VLAN as teh server, you can
       | inject commands. The difficulty is that every BACnet server is
       | somewhat different, though most have spec online.
        
       | ambalangoda wrote:
       | I just gotta say, I really like the animated gifs. Kudos to the
       | blogger.
        
       | KennyBlanken wrote:
       | What is with this absurd headline? Imitating your RF thermostat
       | isn't "attacking" anything.
        
       | mattmaroon wrote:
       | I would probably just go about this by heating/cooling the
       | thermostat itself rather than messing around with radio signals.
       | Put a little box around it and something that could control the
       | temp in the box, like a little peltier element. When you want the
       | heat to run, cool the inside of the box. When you want it to
       | stop, warm it up. Etc.
       | 
       | But then I build thermal control devices for fun so maybe it just
       | seems like a much easier method to me.
        
         | pards wrote:
         | X-10 devices [0] that do this have been around for a long time.
         | I've even seen elaborate setups that can be controlled via a
         | landline.
         | 
         | [0]: https://thex10shop.com/products/x10-powerhouse-
         | th2807-thermo...
        
       | pete1302 wrote:
       | Men in Black suit knocking on the door for this is a First-world
       | thing.
        
       | tgtweak wrote:
       | I would have put a peltier/TEC below the thermostat to influence
       | it's measured air temp vs resorting to reverse engineering and
       | illegal signal broadcasting.
        
         | noncovalence wrote:
         | If I understood the OP correctly, then the broadcasting would
         | only be illegal in the US.
        
       | jorisboris wrote:
       | I need this solution
       | 
       | Our landlord installed a Honeywell home, the cheapest version,
       | and it has no remote or timer capabilities
       | 
       | And especially in winter it would be nice if it would jump on
       | before we wake up!
        
       | xbar wrote:
       | The UK's Online Safety Act is pretty horrific. Our friends in the
       | UK have my sympathy.
        
       | lenerdenator wrote:
       | > Please do your due diligence and check local laws before
       | attempting anything I do in this post. Transmitting radio signals
       | can become legally problematic very quickly, and the band I
       | specifically transmit on here (868Mhz) is illegal in the United
       | States without a license. I'd rather you didn't have men in suits
       | knocking on your door on my account. You've been warned!
       | 
       | Let's be honest here: the FCC is gonna have to see a _helluva_
       | lot of problems coming from your transmissions before they bother
       | to send the black Suburbans filled with men in suits to knock on
       | your door. You 're going to get a series of letters that
       | basically say "please don't do that" if anything.
        
         | johnwalkr wrote:
         | An American thermostat would be using around 920MHz which is
         | the equivalent unlicensed band in the US. Funnily enough, the
         | author warns Americans as an example but he is running more
         | foul of the local rules an American would be (assuming an
         | American would use 920MHz and not 868MHz).
         | 
         | In the US you are allowed to tinker around there with home-
         | built RF devices for personal use and prototyping in unlicensed
         | bands, to some extent. Although, using an SDR for this requires
         | a certain interpretation of the rules. In Europe it's basically
         | not allowed, one shall only use pre-certified modules. Or only
         | use the device you've built in an RF anechoic chamber until
         | you've undertaken the certification process (totally
         | impractical for a hobbyist).
        
       ___________________________________________________________________
       (page generated 2025-04-22 23:01 UTC)