Home Automation: Reverse engineering a Worcester-Bosch DT10RF wireless thermostat.

Way back in 2007 I had a new boiler and central heating system installed. I chose the Worcester-Bosch Greenstar 30CDi combi-boiler as the heart of the system since the manufacturer has a very good reputation for reliability and efficiency.

Worcester-Bosch Greenstar 30CDi

This boiler has various control systems that can be used to operate the heating and direct hot water. I selected the DT10RF Optimising Digistat since, although it was quite expensive, it was the best Worcester-Bosch offer and promised further cost-savings through the use of its “optimising” feature.

Worcester-Bosch DT10RF Mk I

The DT10RF controls both the operation of the central heating, and also the timing of the hot-water pre-heat function which allows the boiler to deliver hot water more quickly. When running the heating, the optimiser function calculates the time the boiler needs to start in order to reach the correct temperature at the programmed times.

You can set up to four different time periods for each day of the week for heating. You can set the room temperature for each of these four periods. The timing for hot water can be different for each day of the week. The wall-mounted room thermostat is wireless and uses the standard 433MHz band. This controls the temperature for the heating, and the boiler mounted receiver controls the timings of the hot-water pre-heat.

Right from the beginning I’ve never been very satisfied with this control system. Firstly, the “optimising” feature only works to delay the on-time of the heating, and does nothing to optimise the time the heating turns off which it could do by learning the time it takes the house to cool down. Not only that, but it only optimises the first time-slot of the day so only the morning start-up is optimised. The time at which the temperature set-point changes from day-time to evening is not optimised. Also, the optimisation will only delay the heating coming on in the morning for up to one hour. Since it takes my heating at least one hour to warm the house up, the optimiser basically never did anything at all.

While it is true that you can set four different time periods each day for the heating, you can’t change the temperature set point. The set point for each of the four time slots is set once, and then applies every day. So you can’t have complete flexibility in how the heating is configured.

Even the wireless side of the thermostat has never been very reliable, with the signal constantly dropping out and requiring the transmitter to be temporarily moved closer to the boiler and the set point manually turned up and down to give the system a kick and get the communication going again. It’s certainly not fun waking up on a cold winter morning to find the heating hasn’t come on because, yet again, the wireless communication has failed over night. This is with a house of normal construction, and not a huge distance between the transmitter and receiver. I did have the control system replaced under warranty, but the new one was no better. There are lots of posts on the internet where people are experiencing the same problems with the DT10RF. Worcester-Bosch blame anything from too-thick walls to interference from WiFi access points. That is simply not acceptable, and the design of the wireless system is frankly not fit for purpose.

Since purchasing this thermostat Worcester-Bosch have released a new version, the DT10RF Digistat optimiser (MK II). From what I can tell, aside from having six time slots rather than four, it is simply a cosmetic change. I don’t expect this version to be any more reliable, and from forum posts it looks like the same problems still exist.

The last straw was when, during the previous winter, the thermostat simply refused to work when it was any further than about two metres away from the boiler. This was with a fresh set of batteries, and the whole thing reset and reprogrammed from scratch. Hardly any point in it even being wireless.

Time to start looking for a new heating control system.

Ideally I would like something that connects to my local network, either WiFi or Ethernet. This would make it easy to programme, and also remotely adjustable over the internet. This would mean that when I’m out somewhere and I’m going to be back home later than expected, I can easily change the timing of the heating so that it comes on later and does not burn gas unnecessarily.

I would also like something that is far more intelligent than the current heating control systems. I want it to learn how long it takes the house to warm up and cool down, and decide for itself when the heating needs to be on. Rather than saying “I want the set point to change from 12C to 20C at 4pm”, I want to be able to say “I want the house to be 20C at 5pm” and have the system work out itself when to fire the boiler, based on the outside temperature and its own knowledge of how quickly the house warms up. Likewise, I want to say “I’m happy for the temperature to have dropped to no less than 18C by 11pm” and have the system work out itself when it can stop heating, based on its knowledge of how quickly the house cools.

I want to have multiple temperature sensors around the house, to get an overall view of the system, rather than just the temperature state in one room. It could decide which sensor gets to control the heating based on the time of day. For example, in the mornings I only care about the temperature of the bedrooms. I’m not worried about the temperature of the downstairs open-plan area that typically takes a lot longer to warm up, since I’ll very shortly be leaving to go to work. So the master bedroom could control the system in the morning, while the lounge controls the system in the evening.

It could also do other nifty things, like if the current temperature is below the set point at 8am, but the local weather forecast pulled from the internet predicts that it is going to be a lovely day and warm up by 10am, then it could decide to not turn on the heating at all. I don’t want it to burn gas for two hours just because the morning is a little chilly, and then end up having to open a window once the sun comes out.

Looking around the central heating market, I see several manufactures are now producing WiFi enabled thermostats, such as the Heatmiser PRTHW-TS WiFi. However, not only are they very expensive and get some poor reviews, they also don’t appear to do what I want. They allow only programming over WiFi, they don’t do anything clever regarding heating control.

I decided what I really want to be able to do is control the boiler from my PC. If I could send a command to turn the heating on or off, I could then write my own code to control it and have it do whatever I want.

I know that the DT10RF uses the 433MHz band to transmit the on/off signal. If only I could capture the signal it sends, I could then reproduce it and take control. I decided to purchase a 433MHz transmitter and receiver pair from eBay. At a price of just £2.80 it was worth a gamble as to whether I would be able to receive anything from the thermostat.

433MHz Wireless Receiver

One slightly annoying thing about these cheap 433MHz receivers is that when there is no signal present, their Automatic Gain Control circuit gets ramped up and all you get is receiver noise on the data pin. This makes it rather difficult to actually pick out any data from the noise. Luckily, you get about 100mS of “radio silence” after a signal has been received before the AGC winds back up again. So it is possible to look for this silence, and then look for the data immediately before it in order to “sniff” the signal.

I hooked up the data pin of the receiver to an oscilloscope, and sure enough when I turned the thermostat up I could see a signal go through. Likewise when I turned it back down, another signal was visible. It was impossible to capture the signal to analyse it since it was far too fast. Since I didn’t have access to a storage-oscilloscope, I decided to make use of a “soundcard logic analyser” that I had made previously.

Signal Capture

By feeding the signal from the receiver into the soundcard on my computer, I could capture the data continuously and then look at the signals at my leisure. I connected it all up, and turned up the thermostat until it started calling for heat. It visibly sent an “on” signal three times. I then turned it back down again, and it sent an “off” signal three times. You can see the data in the screenshot below. The 100mS periods of “radio silence” make the data stand out easily from the receiver noise. In the data below there are three on-pulses separated by approximately 1.9 seconds, followed by three off-pulses separated by 1.9 seconds.

DT10RF Transmission

Zooming in on one of the “on” transmissions we can see the following pulse train.

DT10RF Boiler ON

Zooming in on one of the “off” transmissions we can see the following pulse train.

DT10RF Boiler OFF

As you might expect, the signals are nearly identical except for the last few pulses. I haven’t made any attempt to work out what it is actually sending, except to recognise that there appears to be a “preamble” that is used to give the receiver time to adjust its AGC, followed by a series of pulses that represent the boiler/thermostat ID, followed by either the “on” or “off” message.

By simply writing down the lengths of the high and low pulses it is possible to reproduce them using a microcontroller and 433MHz transmitter. I’ve been using Atmel AVR ATMega328P microcontrollers in a lot of projects lately, so I decided to use one here as well. This one is mounted on an Arduino Uno board. It’s simple to connect up the transmitter, just power and ground, and the data pin connected to pin 2 of the Arduino (PORTD, PD2, pin 4 of the IC).

433MHz Wireless Transmitter

It works! I can turn the central heating on and off again using my PC. Now that I have full control of the system I can work on writing some algorithms that optimise comfort and, most importantly, minimise gas usage. Helpfully it also seems to have much better range than the transmitter in the commercial thermostat - I can easily activate the heating using my laptop over on the other side of the house from the boiler. If I find that I need even more range, the transmitter can be operated from up to 12V with increased transmission power. At the moment I am powering it with the normal 5V logic supply to the microcontroller.

The following code-snippet shows how I control the 433MHz transmitter. It’s only intended to be an example, you probably wont be able to just cut and paste it into your own Arduino sketch since I don’t use the Arduino framework. But it is simple enough to follow and can easily be made to work in your own application.


If you want to try to control your own Worcester-Bosch boiler and have a DT10RF thermostat, you should be able to use the same RF messages as me provided you put your boiler into “learn” mode and then transmit the “on” signal so that the boiler knows what messages to expect. If, like me, you want to be able to switch seamlessly between computer control and the thermostat whilst you develop your heating control application then you’ll need to follow the procedure I have detailed and capture the code your own thermostat is sending.

In the next tutorial, I’ll detail how to build your own inexpensive wireless temperature sensors for distributing all over your house. After all, what use is having control of the heating system if we don’t know what the temperature is?