Attacking My Landlord's Boiler

The original product understandably arrives with heavily-restricted firmware (I imagine to reduce the amount of flak the company receives). However, it is incredibly easy to install Flipper Unleashed or similar, which removes all said restrictions and adds a lot of additional functionality.

Possessing the tools that could be used to commit a crime is not necessarily a crime in and of itself! Just be careful with what you do or, depending on what country you’re in, you might find some men in suits knocking at your door.

Personally, I wanted to replay “encrypted” 433MHz signals for my own devices (electric gate, roller door, roller shutters, …) and this was disabled with the Flipper’s region set to Australia.

In particular: stable and individually adjustable temperatures for bedrooms and living rooms; underfloor heating in some rooms (bedrooms), radiator-based heating in some others (living room), and combined UFH+radiators in some others (where UFH might not be enough during extreme colds).

I thought I can just pay someone some money and they'll set up the controls for me. It must be a simple exercise, right?

I could not have been more wrong. After spending a few hours of understanding the setups that "experts" have recommended, I figured out edge cases where they would be either wasteful or uncomfortable (meaning: unnecessary and inavoidable temperature overshoots or undershoots, etc.). I had many-many rounds with Honeywell, Tado, Siemens, etc. and every single one of them had _major_ issues.

The renovation got a bit stuck because of this, but the plumbing was ready so I wanted to see whether the pluming and pumps are working, at least. So I connected the pumps and valves to "smart plugs", i.e. Zigbee-controlled plugs, so that I can see that they turn on. They did, which got me thinking...

Right now I have $20 Zigbee temp sensors sprinkled across the house, $30 smart plugs and relays driving valves, pumps and the boiler, and Home Assistant is controlling the whole thing. Everything works perfectly and I could implement some features that simply no system would have done out of the box, for example in rooms where there's combined UFH and radiators I can drive both heating systems when the target temperature is far from the desired (so that the room heats up quickly) but as the room temp is getting closer to the target, the radiators are turned off so that UFH dominates heating (more comfortable and more energy efficient than radiators). In rooms with radiators, temp is +- 0.4 C within target, in rooms with UFH, it's +-0.1C within target.

I target the long run time to maximize efficiency. A 160°F pipe will lose more heat to the part of the building that I don’t want to heat as well as more heat to the wall right behind the radiators. It also results in the house going micro too-hot, too-cold, too-hot, too-cold as it cycles. Mine is constantly trickling in just enough heat to replace the heat lost instead of cycling between adding way more than needed then none for a while.

Another large effect is that low return water temperatures into the boiler allow for greater condensation of exhaust gas energy to be used in the building instead of sent outside. Walking by my house on a cold day, you’ll see minimal steam plume during operation. All that steam I see my neighbors emitting is energy they paid for and delivered to the outside… (They paid a lot for a boiler with a 95% or 98% sticker and run it at 80% efficiency.)

https://kw-engineering.com/how-to-optimize-condensing-boiler...