Wednesday 26 March 2014

Hacking the signals from a DT10RF

I ranted about the DT10RF here, in my last post but instead of replacing the thermostat with something 'better' I've decided to stick with it and build something myself.

To give you some idea, all you need for a basic controller is an Arduino, a 433Mhz transmitter, a TMP36 temperature sensor, some wires and a little coding skill and you can build something that works to the same functionality as the DT10RF but instead of being £160 you're looking at less than £25 for the parts. No screen, no interface and without hours of coding/design you've still got nothing... but where's the fun in buying something already built? ;)

First step.
Work out what the controller sends to the boiler to make it turn on / off.

Fortunately I'm treading in the footsteps of those before me somewhat and all I have to do is replicate his work. Different model thermostat but same manufacturer and thus expected to be broadly the same (it was :))

This post is pretty much a rehash of his, I have quite literally followed what he did - I'm just providing my own take and pictures on the subject to help others in the future.

Like Steven, I didn't have an oscilloscope so I built the same logic gate analyser he described. As he explains, the idea is that you can use a soundcard with a cable plugged into its mic socket to record the signal. Sound cards only like up to 2v being thrown at them, logic signals (the kind we're reading anyway) are 5v so we have to bring that voltage down.

I started with an old stereo cable and cut it in half. Separated the two cables and their sheaths.


Solder a 18k resistor and length of wire to the sheath on both sides. Then solder an 82k resistor onto the end of the 18k and also attach the 'main' wires of the cable to the mid point between the two resistors.


Attach two more cables to the end of the 82k resistor, wrap it all up and voila, you have a two channel logic analyser.

All you need at this stage is to power the receiver, here I've got it plugged into a breadboard along with an Arduino Nano. The Nano provides 5v (red cable) over to the receiver. The white cable is the antenna, black cables are all ground, green cable is the data cable going back to the Nano (not used yet).



The four cables heading off in the top right are the cables from the logic analyser. Both connected across the data pin on the receiver to ground.

Once you've got that wired up, connect the other side of the stereo cable to the mic socket on your computer and plug in the Arduino to power it.


On the laptop run Audacity (or similar sound recording program) and hit record whilst you turn the heating on or off. As you can see in the picture, you'll (hopefully!) get distinct patterns as the thermostat does its thing.

I did this with the receiver antenna drapped over the thermostat to get a really nice clear signal. It worked from the next room as well but with a lot more noise. When it comes to interpretting what was going on, clearer = better!

Like the older model Steven has, the newer thermostat does the same thing - it pings each command three times with short gaps (roughly 2 seconds) between each attempt. This is because the boiler doesn't feedback when it receives a command - the thermostat can transmit only. It just blindly transmits its signals and keeps its fingers crossed and does so three times to improve the chance of one of those signals making it.

Zooming in (a lot!) on those spikes shows clear pulses:

You're looking for this BEFORE the clear sections on the recording. There's a lot of noise on these cheap receivers when they're doing nothing and automatic gain control takes 100ms or so after its finished receiving to ramp back up into noise making duty. They work fine though (and for £2 off ebay you really can't go wrong...)!

Also recommend setting audacity to something higher than its default of 44Khz (I used 192Khz). The higher you go the more samples it records thus the more accurate your pulses will be. You need to measure the timings of them next...

No comments:

Post a Comment