BMW Gen5 TPMS support

[petrjac]

Hi,

I'm trying to decode BMW Gen5 TPMS sensors.

I recorded several samples using Airspy R2 SDR - https://github.com/merbanan/rtl_433_tests/pull/463/files .

I was able to read raw data using URH and resolved CRC-8 as poly=0x2f init=0x40:

0xfff20323e136a14a3e016b686b
0xfff20323e136a1343d017468cf
0xfff20323e137a81b3e005a68dc

However with rtl_433 I'm getting different results:

❯ rtl_433 -r tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16 -R 0 -X 'n=tpms_bmw,m=FSK_MC_ZEROBIT,s=25,l=25,r=100' -Y minmax
rtl_433 version 23.11-19-g83afc7b4 branch master at 202312252023 inputs file rtl_tcp RTL-SDR SoapySDR with TLS
Disabling all device decoders.
[Input] Test mode active. Reading samples from file: tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @0.002138s
model     : tpms_bmw     count     : 1             num_rows  : 1             rows      : 
len       : 104          data      : 00020323e136a14a3e016b686b
codes     : {104}00020323e136a14a3e016b686b

Binary data started with 0x000 instead of 0xfff.

Could please someone help with verifying data before proceeding?

[zuckschwerdt]

It's basically the same. MC can't reliably discern the timing of the short transitions until the first long one.

[petrjac]

Does it make sense then calculated CRC for stripped data:

❯ bin/i386-linux/reveng -w 8 -s 0323e136a14a3e016b686b 0323e136a1343d017468cf 0323e137a81b3e005a68dc 0323e136a1403e016f6830 0323e136a1343d017468cf
width=8  poly=0x2f  init=0xaa  refin=false  refout=false  xorout=0x00  check=0x2a  residue=0x00  name=(none)

?

[petrjac]

With bitbench I am able to guess:

• sensor ID
• pressure [bar]
• nominal (target?) pressure [bar]
• temperate [°C]
• CRC

Should I investigate more or could I try to prepare decoder?

[zuckschwerdt]

0xaa as init seems much nicer than 0x40. And we usually expect a preamble. The resulting raw aaaa aa59 preabmle does not look plausible (at least we have not seen such before). We can't be sure until the data fields are decoded.

[zuckschwerdt]

Looks good already. You might be missing the alarm flags like rapid deflate, low battery and diagnostics as spinning, triggered, ...

[petrjac]

I tried to guess couple more columns - bitbench, but some of them are hard for me to verify.

I'm using diagnostic tool as reference:

What should be the next steps?

[zuckschwerdt]

PR a decoder if you like :) Look into the other TPMS decoders and copy one that looks clean and simple.

[ProfBoc75]

Binary data started with 0x000 instead of 0xfff.

Could please someone help with verifying data before proceeding?

Hi @petrjac : try to increase the pulse to 27 instead of 25 and you will get the 0xfff, if you reduce to 24 you will get the 0x000

[zuckschwerdt]

increase the pulse to 27 instead of 25 and you will get the 0xfff, if you reduce to 24 you will get the 0x000

That's unexpected. For MC we don't need an exact timing and the slicer should always match. Does this slight change somehow match/ignore the first "bit"? That would change the assumption about 000 vs fff.

[petrjac]

• s=25 → {104}00020323e136a14a3e016b686b
• s=26 → {104}40020323e136a14a3e016b686b
• s=27 → {104}7ff20323e136a14a3e016b686b

When trying with tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16

 ❯ rtl_433 -r tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16 -R 0 -X 'n=tpms_bmw,m=FSK_MC_ZEROBIT,s=27,l=27,r=100' -Y minmax
rtl_433 version 23.11-19-g83afc7b4 branch master at 202312252023 inputs file rtl_tcp RTL-SDR SoapySDR with TLS
Disabling all device decoders.
[Input] Test mode active. Reading samples from file: tests/BMW_G5_TPMS/g018_433.92M_2500k.cs16
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @0.002138s
model     : tpms_bmw     count     : 1             num_rows  : 1             rows      : 
len       : 104          data      : 7ff20323e136a14a3e016b686b
codes     : {104}7ff20323e136a14a3e016b686b

[zuckschwerdt]

Thanks for confirming! That does not seem right, we need to look into that. I can try to rewrite the MC slicer with that nice example we have here.
(Idea: on leading short pulses push to a counter and only add the bits when the position later is confirmed.)

[ProfBoc75]

Hi @zuckschwerdt , @petrjac :

FYI, I drafted a decoder, and started listening to the cars passing on my street.

Sounds like the bitbench is not exactly as expected, I need to consolidate my findings in a table and back here soon.

About the rf decode part, I'm using FSK_PCM, s=l=25, r=100, then looking for preamble = 0xaa59 then MC decode + Invert.

Data Layout :

Brand / Manuf   : 8h, I found at least 3 values : 0x03 (=3),  0x23 (=35) and 0x80 (=128)
Sensor ID       : 32h,  4 byte Sensor ID
Pressure        : 8h, purpose to be confirmed, formula not guess yet
Temp            : 8h, Temp sound to be OK , `Temperature_C - 50`   (with this formula temp - 50 , I have some around 12 or 13°C matching my local temp and other more around 17 to 19°C, may be cars coming from garage ?)
Warn / Tags 1   : 8h, purpose to be confirmed, some incremental values here
SEQ_ID / Tags 2 : 8h, purpose to be confirmed,
Target Pressure : 8h, purpose to be confirmed, formula not guess yet, could be a third tag.
CRC             : 8h, CRC-8 poli 0x2f  , init 0xaa

The pressure values, I'm not able yet to find a simple formula to convert value into kPa or PSI , I need more samples for that.
For WARN and SEQ_ID do not match the purpose, as WARN may also increase too and I don't have the valves, so I can't confirm. Theses tags are related to the tire/flat type, its size, programmed by the RDC Tool. And we should have here the battery, fast deflating alert too.

Notice that the captures from Airspy @ 10MHz are not readable by rtl_433 (no error, but only partial value), only the 2.5MHz give expected results with -Y minmax.

[petrjac]

@ProfBoc75 you are faster than me :), I was planning to write decoder on the weekend.

I'l be happy to help you at least with my findings:

• Brand / Manuf - considering it as unknown

• Pressure - could by DEC * 0,0245 to get pressure in bars

  • Ref. press [bar] is value from diagnostic software

  HEX	DEC	Ref. press [bar]	round(DEC * 0.0245, 2)
  2F	47	1.15	1.15
  2A	42	1,03	1.03
  26	38	0.93	0.93
  1B	27	0.65	0.66

• Temp - could be DEC - 52, would need more data

  HEX	DEC	Ref. temp [°C]	DEC - 52
  3E	62	10	10

• Warn / Tags - unknown

• SEQ_ID / Tags 2 - this could be some message id increment by one. I saw always 3 exactly same messages with same SEQ_ID followed by next 3 messages with SEQ_ID incremented by 0x01.

• Target Pressure - unknown, but interestingly:
  0x68 = 104, ROUND(104 * 0.0245, 2) = 2.55 is similar to 2.53 reported by diagnostic software

• CRC - should be OK

[ProfBoc75]

I noticed also that , depends on the first byte , Manuf/Brand, the coding is not the same, And for 0x80 (128) sounds to be Continental model.

There is another discussion here where the data packet is also 11 byte
Starting with a Brand ID (0x80) then the Sensor ID (4 byte) , 01 or 02, then temp, pressure and or tags information then exactly the same CRC-8 poli 0x2F, init 0xaa.

The RF part is not the same (not Manchester coded), but the data formatting sounds to be very close, just not information in the same order as Brand HUF (0x03).

if we guess all the formula and with DATA_COND, we may be able to handle these 2 Brands.

Edit : looking at the RDC Production information guide (page 20, 3. Operation picture) , the third brand could be "Schrader" trademark of "Sensata", and I notice that from my street :

2x xx xx xx = HUF Sensor ID , brand = 0x03 (3)
3x xx xx xx = Continental ID, brand = 0x80 (128)
5x xx xx xx = Schrader/Sensata ID , brand = 0x23 (35)

[ProfBoc75]

FYI, it takes time to collect metrics and to deep dive, since I'm trying to manage the 3 brands in the same decoder, and not so much cars in my one way street.

At least the brand 0x03 / Huf Gen 5 is ok for me without the flags decoding which require some work, we don't know which bit is related to battery, fast deflating and so on ...

[petrjac]

In diagnostic sw data I have found more manufacturer for TPMS:

• Autonet
• HUF
• Continental
• TRW
• Sensata
• Unknown manufacturer

However I cannot be sure that list is correct/complete.

On the weekend I'll try to receive signals from HUF sensors to confirm temperate, pressure and maybe also alarm tags.

Interestingly the RDCi gen 5 sensors should also send tire size ...

[ProfBoc75]

Hi, I collected some data from the street :

I kept the original order to get the sequence number increasing if any.
Notice a new detect Brand 0x88, only one message captured.
All of them are similar for the 4 first data: Brand, ID, Pressure and Temp
The 3 last bytes (except CRC) have not the same behavior, some are fixed, other are variable, but they reflect the reality from the street.
So I tried to guess the data layout :

_______________________________________________________________________________________________________________________
|                               |                                              |                    | Decimal Values  |
| Msg                           | Data layout                                  | Comments           |  B7 |  B8 |  B9 |
| BB IIIIIIII PP TT F0 F1 F2 CC |                                              |                    |  F0 |  F1 |  F2 |
| 03 23b3dd0f 6d 43 57 71 e8 ae | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  87 | 113 | 232 |
| 03 23b3dd0f 6d 43 6b 71 e8 e9 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 107 | 113 | 232 |
| 80 33ca4f80 6c 3e 31 0e 09 74 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  14 |   9 |
| 80 33ca4f80 6c 3e 31 0e 0a 05 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  49 |  14 |  10 |
| 80 33ca4f80 6c 3e 31 0e 0b 2a | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  49 |  14 |  11 |
| 80 33ca5530 6c 3e 32 1c 0e 23 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  50 |  28 |  14 |
| 80 33ca5530 6c 3e 32 1c 0f 0c | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  50 |  28 |  15 |
| 80 33ca63b0 6a 3f 31 08 07 ce | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |   8 |   7 |
| 23 501a8308 63 44 63 67 c5 ab | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  99 | 103 | 197 |
| 23 5258ba4b 6c 45 49 71 e1 c3 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  73 | 113 | 225 |
| 23 5258ba4b 6c 45 5e 71 e1 09 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +21 |  94 | 113 | 225 |
| 23 5258ba4b 6c 45 83 71 e1 93 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +37 | 131 | 113 | 225 |
| 23 5258c379 6f 45 70 71 e1 59 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 112 | 113 | 225 |
| 23 5258c379 6f 45 84 71 e1 52 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 132 | 113 | 225 |
| 80 30b30da4 5d 3f 6a 21 09 2c | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 106 |  33 |   9 |
| 80 30b30da4 5d 3f 6a 21 0a 5d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 106 |  33 |  10 |
| 80 30b30da4 5d 3f 6a 21 0b 72 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 106 |  33 |  11 |
| 80 33ca4f80 70 44 31 29 0e e9 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  41 |  14 |
| 80 33ca4f80 70 44 31 29 0f c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  49 |  41 |  15 |
| 80 33ca63b0 6a 41 31 16 0e a7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  22 |  14 |
| 80 30b30da4 5d 3d 6a 15 0a a2 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 106 |  21 |  10 |
| 80 30b30dbf 69 3f 6a 0a 05 63 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 106 |  10 |   5 |
| 80 385135e3 5b 42 21 0d 09 50 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  33 |  13 |   9 |
| 80 385135e3 5b 42 21 0d 0a 21 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  33 |  13 |  10 |
| 80 385135e3 5b 42 21 0d 0b 0e | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  33 |  13 |  11 |
| 80 385135de 5b 41 1f 0d 09 74 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  31 |  13 |   9 |
| 80 385135de 5b 41 1f 0d 0a 05 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  31 |  13 |  10 |
| 80 385135de 5b 41 1f 0d 0b 2a | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  31 |  13 |  11 |
| 80 35ac8aa2 5e 3e 38 21 0d ea | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  56 |  33 |  13 |
| 80 35ac8aa2 5e 3e 38 21 0e 9b | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  33 |  14 |
| 80 35ac8aa2 5e 3e 38 21 0f b4 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  33 |  15 |
| 23 235d2558 63 3e 51 78 e9 f9 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  81 | 120 | 233 |
| 23 235d2558 63 3e 65 78 e9 ce | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 101 | 120 | 233 |
| 23 235d2558 63 3e 79 78 e9 66 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 121 | 120 | 233 |
| 80 3edad6e7 71 0e 18 12 09 61 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  18 |   9 |
| 80 3edad6e7 71 0e 18 12 0b 3f | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +2  |  24 |  18 |  11 |
| 80 3ec301f1 74 10 18 0d 0a 44 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  13 |  10 |
| 80 3ec301f1 74 10 18 0d 0b 6b | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  24 |  13 |  11 |
| 80 3edad6e9 73 12 18 0f 0a 17 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  15 |  10 |
| 80 3edad6e9 73 12 18 0f 0b 38 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  24 |  15 |  11 |
| 80 3edad6af 73 13 18 0c 09 2d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  24 |  12 |   9 |
| 80 3edad6af 73 13 18 0c 0a 5c | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  24 |  12 |  10 |
| 80 3b1446f7 63 0b 08 12 0a a6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |   8 |  18 |  10 |
| 80 3b1446f7 63 0b 08 12 0b 89 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |   8 |  18 |  11 |
| 80 3b2306b1 55 0d 09 16 0d 8d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |   9 |  22 |  13 |
| 03 235d2558 63 3e 97 78 e9 ae | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 151 | 120 | 233 |
| 03 235d2566 6b 3e a4 7b ea 5e | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 164 | 123 | 234 |
| 03 235d2566 6b 3e b8 7b ea f6 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 184 | 123 | 234 |
| 88 22a555bd 64 42 e6 04 c5 8c | Brand ID Pressure Temp ????  ????   ???? CRC | NEW Brand          | 230 |   4 | 197 | 
| 03 20325efb 6b 41 55 7a e1 7e | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  85 | 122 | 225 |
| 03 20325efb 6b 41 69 7a e1 39 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 105 | 122 | 225 |
| 03 20325efb 6b 41 7d 7a e1 e1 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 125 | 122 | 225 |
| 23 20325711 60 3f 77 62 e1 d9 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 119 |  98 | 225 |
| 03 20325ed5 5f 3f 54 79 e1 f3 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  84 | 121 | 225 |
| 03 20325ed5 5f 3f 7c 79 e1 6c | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +40 | 124 | 121 | 225 |
| 80 323275d4 60 41 39 21 0d 15 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  57 |  33 |  13 |
| 80 323275d4 60 41 39 21 0e 64 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  57 |  33 |  14 |
| 80 323275d4 60 41 39 21 0f 4b | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  57 |  33 |  15 |
| 23 22dacf9c 5b 40 6b 67 e9 46 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 107 | 103 | 233 |
| 03 22daced9 60 41 44 62 e9 b0 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  68 |  98 | 233 |
| 03 22daced9 60 41 58 62 e9 18 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 |  88 |  98 | 233 |
| 03 22daced9 60 41 6c 62 e9 2f | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 108 |  98 | 233 |
| 03 22dad000 62 41 58 7e e9 f7 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  88 | 126 | 233 |
| 03 22dad000 62 41 6c 7e e9 c0 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 108 | 126 | 233 |
| 03 22dad000 62 41 80 7e e9 5b | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 128 | 126 | 233 |
| 80 35b9e4b7 62 3d 38 1e 09 d0 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  56 |  30 |   9 |
| 80 35b9e4b7 62 3d 38 1e 0a a1 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  30 |  10 |
| 80 35b9e4b7 62 3d 38 1e 0b 8e | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  56 |  30 |  11 |
| 80 359a9603 5d 3d 38 21 0d cd | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  56 |  33 |  13 |
| 80 33ca5530 6c 3e 32 1a 09 c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  50 |  26 |   9 |
| 80 33ca5530 6c 3e 32 1a 0a b7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  50 |  26 |  10 |
| 80 33ca5530 6c 3e 32 1a 0b 98 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  50 |  26 |  11 |
| 80 302b6733 56 3e 2e 27 09 29 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  46 |  39 |   9 |
| 80 33ca4f80 74 4b 31 32 0e f6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  49 |  50 |  14 |
| 80 30b30dbf 6b 42 69 19 09 b7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 105 |  25 |   9 |
| 80 30b30dbf 6b 42 69 19 0a c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 105 |  25 |  10 |
| 80 30b30dbf 6b 42 69 19 0b e9 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 105 |  25 |  11 |
| 03 20298428 5b 40 9b 74 e0 09 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 155 | 116 | 224 |
| 03 20298428 5b 40 af 74 e0 3e | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 175 | 116 | 224 |
| 03 20298428 5b 40 c3 74 e0 68 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 195 | 116 | 224 |
| 80 321ee91b 6b 44 73 24 0a fe | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 115 |  36 |  10 |
| 80 321ee74d 6c 43 73 2e 09 8d | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    | 115 |  46 |   9 |
| 80 321ee74d 6c 43 73 2e 0a fc | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 115 |  46 |  10 |
| 80 321ee74d 6c 43 73 2e 0b d3 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  | 115 |  46 |  11 |
| 80 339f2707 6a 3d 30 3a 09 16 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  48 |  58 |   9 |
| 80 339dd753 78 3e 30 45 09 c6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  48 |  69 |   9 |
| 80 339dd753 78 3e 30 45 0a b7 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  48 |  69 |  10 |
| 80 339dd753 78 3e 30 45 0b 98 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  48 |  69 |  11 |
| 80 339ee6b8 68 3d 30 12 0d f6 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  48 |  18 |  13 |
| 80 339ee6b8 68 3d 30 12 0e 87 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  48 |  18 |  14 |
| 80 37569b5b 54 3f 5e 08 05 54 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  94 |   8 |   5 |
| 80 37569b5b 54 3f 5e 08 06 25 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  94 |   8 |   6 |
| 80 37569b5b 54 3f 5e 08 07 0a | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC | SEQ = previous +1  |  94 |   8 |   7 |
| 23 53c66eda 63 45 01 6f e5 3c | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |   1 | 111 | 229 |
| 23 53c66eda 63 45 01 6f e5 3c | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous     |   1 | 111 | 229 |
| 23 53c66a43 69 49 01 6f e5 a1 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |   1 | 111 | 229 |
| 23 53c66a43 69 49 01 6f e5 a1 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous     |   1 | 111 | 229 |
| 23 235d5efa 6d 41 61 6a e9 3b | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |  97 | 106 | 233 |
| 23 235d5efa 6d 41 75 6a e9 e3 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 117 | 106 | 233 |
| 23 20d4585d 6b 3e 87 79 e5 7e | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 135 | 121 | 229 |
| 23 20d52850 62 3e 79 62 e1 ae | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 121 |  98 | 225 |
| 03 23561022 5e 3f 01 74 e9 62 | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    |   1 | 116 | 233 |
| 03 23561022 5e 3f 01 74 e9 62 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous     |   1 | 116 | 233 |
| 03 23560f93 64 3f 65 67 e9 ee | Brand ID Pressure Temp SEQ Flags1 Target CRC |                    | 101 | 103 | 233 |
| 03 23560f93 64 3f 79 67 e9 46 | Brand ID Pressure Temp SEQ Flags1 Target CRC | SEQ = previous +20 | 121 | 103 | 233 |
| 80 3177a541 5e 45 2c 09 06 85 | Brand ID Pressure Temp Flags0 Flags1 SEQ CRC |                    |  44 |   9 |   6 |

[petrjac]

Hi,
I collected some signal and have some notes/questions:

1. Shouldn't we create separate issue for FSK_MC_ZEROBIT as mentioned in comment from @zuckschwerdt ?
2. Not all BMW gen5 signals are correctly recognized, e.g. g082_433.92M_2500k.cs16?
3. Would it be possible to somehow automatically add -Y minmax option for BMW Gen5 TPMS? I understand that this option is necessary.
4. DEC - 52 for temperature seems to be right:
   • 059 ~ 7°C
   • 060 ~ 8°C
5. Pressure reading however does not exactly match with diagnostics readings, e.g. 27 * 0,0245 = 0,66 != 0,65. Some more examples in bitbench.
6. I feel confident about SEQ_ID. I recorded many samples and the pattern is:
   • 3x same data message with same SEQ_ID → would it be possible to ignore repeated occurancy?
   • some separator? (g069_433.92M_2500k.cs16, g073_433.92M_2500k.cs16, g081_433.92M_2500k.cs16)
   • 3x same data message with same SEQ_ID + 0x01
7. Nominal pressure is not correct name for last data byte. I always recorded 0x68 but diagnostic report another values (2,48 bar, 2,45 bar, 2,53 bar).
8. I recorded some strange unknown signal, which looks similar to BMW gen5. Based on signal intensity it could be from same TPMS sensor.
   • ffe40647c282de9a76009ed0a6 - g080_433.92M_2500k.cs16

[zuckschwerdt]

I'm already looking into FSK_MC_ZEROBIT. It's really a problem with the bad input signal.

The minmax discriminator is default on 868 MHz where most TPMS are. It does not work too well for 433.92 MHz, usually OOK.

Try to convert some of your signals to OOK (with FSK proper name would be mark/space not on/off...) and look how noisy the resulting pulses are. rtl_433 -Y minmax -w out.ook file.cs16
We'd want to only see short and long pulses (~25 and ~50 µs). I guess the slicer is working surprisingly well given that input :)

E.g. g018_433.92M_2500k.ook

0 1
1 1
1 1
2 1
2 1
0 28
0 1
1 0
23 1
0 16
0 8
25 0
1 1
0 26
1 0
22 0
1 25
0 1
2 0
24 24
26 1
1 0
1 24
1 1
26 25
27 24
27 24
28 26
26 27
27 51
26 26
52 52
26 27
26 26
26 25
26 26
25 26
27 26
51 26
26 52
26 26
52 52
27 25
26 26
52 26
26 1
1 22
0 3
25 25
1 0
23 0
1 26
26 50
1 1
27 25
26 28
26 24
53 51
27 26
53 26
25 52
53 24
0 1
27 51
53 52
52 52
26 24
2 0
26 26
25 26
53 51
53 52
28 24
52 52
51 1
1 52
28 24
26 1
0 25
53 24
26 24
1 1
26 28
26 26
26 52
25 25
26 25
29 25
26 26
26 25
27 25
26 26
53 51
52 26
1 0
24 51
0 0
53 51
52 26
26 51
53 26
26 52
51 52
26 24
0 1
27 0
0 0
1 24
26 1
1 22
1 0
52 1
1 24
26 51
54 51
52 24
1 0
26 25

[petrjac]

OK, thank you for clarification:). This is probably due unappropriate Soapy params for Airspy R2 rtl_433 -d driver=airspy -g "LNA=8,MIX=8,VGA=11" -s 2.5M. I'm gonna experiment with different params or try sdr without 433M antenna.

[ProfBoc75]

2. Not all BMW gen5 signals are correctly recognized, e.g. g082_433.92M_2500k.cs16?

Checked with :

rtl_433 g082_433.92M_2500k.cs16 -Y minmax -R 252:vv

After MC decoded , missing 1 bit to be a valid message, expected {88} bits, 11x8 , so the message is too short and excluded.

I tried to go further and the CRC failed.

{87}fcdc1ebe90aec4ffaf9704 MC decoded
{87}0323e1416f513b0050687d Inverted, last byte is wrong and CRC failed, expected 0xfa not 0x7d

4. DEC - 52 for temperature seems to be right:

   * `059 ~ 7°C`
   * `060 ~ 8°C`
   

Good for brand 0x03, HUF, sounds like brand 0x80, Continental, the temp is DEC - 50, we need feedback from Continental valve owners to confirm that.

5. Pressure reading however does not exactly match with diagnostics readings, e.g. 27 * 0,0245 = 0,66 != 0,65. Some more examples in bitbench.

From your bitbench, the pressure is clearly = DEC * 2.5 (kPA) or DEC * 0.025 (Bar) , as most of TPMS sensors.

We saw that from other TPMS decoders , value can be coded like that : (DEC - x ) * 2.5 to get the figures.
From your sample 27 = 0.65 Bar, could be (27 - 1 ) * 0.025 = 26 * 0.025 = 0.65 Bar

6. I feel confident about SEQ_ID. I recorded many samples and the pattern is:

   * 3x same data message with same `SEQ_ID` → would it be possible to ignore repeated occurancy?
   * some separator? ([g069_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g069_433.92M_2500k.cs16), [g073_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g073_433.92M_2500k.cs16), [g081_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g081_433.92M_2500k.cs16))
   * 3x same data message with same `SEQ_ID + 0x01`
   

rtl_433 is receiving 3 signals, so each one are decoded.
Did you test the valves in static or rolling situations ? If you look at my table from rolling cars from my street, it's clear that the behavior is not the same, the reason why I kept the 3 flags as is to let external decoding and deep dive. TPMS sensor can report some moving / centrifugal acceleration situation, the opposite of storage state.

7. Nominal pressure is not correct name for last data byte. I always recorded 0x68 but diagnostic report another values (2,48 bar, 2,45 bar, 2,53 bar).

From the RDC tool guide, the temp should be taken into account in the normal pressure, + 0.1 bar / + 10 °C , so may be the temp is not same too ?

8. I recorded some strange unknown signal, which looks similar to BMW gen5. Based on signal intensity it could be from same TPMS sensor.

   * `ffe40647c282de9a76009ed0a6` - [g080_433.92M_2500k.cs16](https://github.com/petrjac/rtl_433_tests/blob/1e49119a7997d3917b9e6597811a7bb3754540f6/tests/BMW_G5_TPMS/2/g080_433.92M_2500k.cs16)
   

I don't understand your point, it's properly decoded with rtl_433 g080*.cs16 -Y minmax -R 252:vv

[luki343]

What bmw part number TPMS this refer?

[petrjac]

For Huf gen. 5 the P/N is 36106877937.

[petrjac]

Hello again,

I recorded several samples with BMW Gen4 sensors. The message format looks similar to Gen5 sensors and also samples collected by @ProfBoc75.
I pushed the samples here - https://github.com/merbanan/rtl_433_tests/pull/466/files

Here is bitbench with decoded data.

I was also able to compare data with official diagnostics.

Notes:

• I was not able to decode signals using rtl_433 version 23.11-51-g2d63f306, I was using Universal Radio Hacker to decode. This could be due weak signal or other issue related to my setup. Can someone please validate?
• The manufacturer 0x80 is really Continental.
• The sensor ID is interpreted as decimal (unlike gen5 sensors).
• Pressure [bar] is probably round((RAW - 1) * 0,025, 1). Displayed as rounded to 1 decimal places (gen5 showed 2 decimal places).
• Temperature is RAW - 52.
• There is no sequence ID.
• Last two bytes is also CRC-8 with poly=0x2f init=0xaa.

[ProfBoc75]

Hi @petrjac: Thanks for this feedback, can you try with this option -R 252:vv to see why it's not decoded.

I'm not able to decode your last 4 x CS16 files.

[petrjac]

@ProfBoc75 I tried this... would this be useful?

> rtl_433 -r g097_433.92M_2500k.cs16 -R 252 -vvvv
rtl_433 version 23.11-51-g2d63f306 branch master at 202402101513 inputs file rtl_tcp RTL-SDR SoapySDR with TLS
[Protocols] Registered 1 out of 252 device decoding protocols
[Input] Test mode active. Reading samples from file: g097_433.92M_2500k.cs16
[Input] Input format "CS16 IQ (2ch int16)"
[Baseband] low pass filter for 2500000 Hz at cutoff 250000 Hz, 4.0 us
Pulse data: 1 pulses
[  0] Pulse: 13804, Gap: 138041, Period: 151845
[Input] Test mode file issued 3 packets

Demodulated signal looks like this in URH:

Raw hex is aaaaaa5995555a55a5656595a96a6669656a59695556995a9a59f8 for g097, fff28030c448e756472601a3b2 after MC.

[ProfBoc75]

@petrjac:

I fact, I wanted you to run rtl_433 in live to see if you are able to get some answers, and I put verbose information in the decoder itself, like data before and after MC, so we can see where it failed and it could help me understand.

This option -R 252:vv will enable only the BMW gen5 decoder with verbose level 2. (correct your Airspy options if I'm wrong)

rtl_433 -R 252:vv -d driver=airspy -g "LNA=8,MIX=8,VGA=11" -s 2.5M -Y minmax

you may test with auto gain with -g ""

From your 4 samples, rtl_433 is not able to decode, preamble not found and raw codes are not well decoded. May be a bad airspy options (signal is overloaded/clipping, too much gain):

rtl_433 -R 252:vv *.cs16 -Y minmax

But from your last raw hex information, it looks like it should work, we can replay with rtl_433 like this:

rtl_433 -y aaaaaa5995555a55a5656595a96a6669656a59695556995a9a59f8

Edit: So for me, apart from the version/generation 4 to be taken into account, it's a signal reception problem to be tuned, playing with the gain and your LNA / MIX / VGA levels or -g "" for auto gain level. Play also with the -Y minmax option could help.

[petrjac]

@ProfBoc75 Thank you for your comment. You are right, the signal is obviously clipping:).

I've been adjusting the gain settings and also forgot to set -Y minmax, but I was finally able to decode using the 252 decoder, so this decoder also works for gen4 BMW TPMS.

Should I upload some samples or try something else?

[ProfBoc75]

@ProfBoc75 Thank you for your comment. You are right, the signal is obviously clipping:).

I've been adjusting the gain settings and also forgot to set -Y minmax, but I was finally able to decode using the 252 decoder, so this decoder also works for gen4 BMW TPMS.

Should I upload some samples or try something else?

Yes, you can upload few other samples into rtl_433_tests with your other gen4 files. Update the README file with pressure and temp details for each file. I would like to check if we can identify the gen 4 from them compare to other gen 5 files.

[petrjac]

@ProfBoc75 I pushed some new samples which can be read (the signal is still noisy and weak though). I also added JSON with data from diagnostics.

The FLAGS3 could be some sefuence number for gen4 continental. I've observed consecutive values of 0xa1, 0xa2, 0xa3, followed by repetition.

[Billymazze]

Howdy,
I'm a complete noob to C language and decoder protocols, but I'm trying to make a decoder protocols for the flipper zero. I've successfully made one for abarth124 spider for TPMS app by Wosk, now I'm trying to make one for bmw tpms sensors. but I'm running into issues trying to get a sensible signal on URH. I have some signals I've captured with URH and the flipper zero Protoveiw app that I'll attach a link for anyone interested. Currently thinking I might be using the wrong frequency, cause the Bimmer geeks diagnostic tool I use say the frequency is 433.00hz not 433.92hz. but this could be the diagnostic tool simplifying it. I'm pretty sure the frequency and signal is correct cause I can replay the signal on flipper zero Protoview view and trigger the tpms warning on the dash.

So far this is what I get in URH,
cccccccd54cab4aaccab4d34acab5332ccd55552aaacd4cccb4d4
cccccccd54cab4aaccab4d34acab5332ccd55552aaacd4cccb4d4
cccccccd54cab4aaccab4d34acab5332ccd55552aaacd4cccb4d4
cccccccd54cab4aaccab4d34acab5332ccd55552aaacd4cccb4d4
cccccccd54cab4aaccab4d34acab5334ccd55552aaacaab5552d4
cdb33335532bd2abb2ba69e5655db6b335d55cd556555aabd6a
ccccd9daa9956955d9d69e69597b6d96cd55553eaacbb695d6a8
cecccced54cd69ff33bd34f3b5f7eebff3aefffefb7dff5f7ff
cccdf76ff6776aaccabda73b2f5ced3bbd77bafabd5e99eddf8
cccccccea995695599569ad2b2d54ccb36aaaa955d669b52aab4
cd99999ab9dd6955dbfdbda5e5a56669b77aabaaa9ea596bd74

Any help is greatly appreciated, thanks.

[ProfBoc75]

@Billymazze : For BMW you need to set modulation to FSK and pulse at 25 µs. For Abarth same FSK but pulse is 52 µs.

[Billymazze]

Could clarify where I need set those values? Do you mean on the flipper zero or in URH recorder? Sorry I'm idiot.

[ProfBoc75]

Could clarify where I need set those values? Do you mean on the flipper zero or in URH recorder? Sorry I'm idiot.

I don't know for flipper zero but for URH you should have modulation option = FSK and the samples/symbol to be adjusted until you have some codes starting with aaaaaa59 or 5555555. I guess you are not so far since the length is little more than 208 bits (after aaaaaa59 preamble) like from your samples.

[Billymazze]

Alright, I'll give that a shot. Any chance the issue is my recoding settings on URH? I recorded these signals with an RTL-SDR (Realtek RTL2838UHIDIR) @433.92mhz with a sample rate of 1.0M, bandwidth of 1.0M, gain of 49, bias tree disabled, and direct sampling disabled. Having issues installing rtl-433, but maybe it's necessary that I get it working.

[Billymazze]

Also forgot to mention these signals I've captured are from a Gen 3 bmw tpms system, 2011 bmw x5 35d.

[petrjac]

@Billymazze the protocol for Gen 3 could be different. Are you able to get TPMS reference data from diagnostics (ISTA)?

Can you provide some samples recorded using URH?

[Billymazze]

I don't currently have access to ISTA D, but I will soon. Currently there's a google drive link in my first post, here. I collected signal with URH and With the flipper zero. I'm not 100% sure my recoding settings are correct, especially gain level. But I can replay the signals and trigger the TPMS warning light with the flipper zero.

[petrjac]

It looks that gen3 protocol differ from gen4/5. I'm not able to find any sense in there ...

The ISTA/D would help, you could also try Android Ediabas app.

Since the protocol for gen3 differs you can consider open separate issue.

[Billymazze]

Alright, I'll create a new issue.

[Gucioo]

At first great job guys! 👍 I recently retrofitted car with Autel MX-2 TPMS sensors and started playing with Noelec RTL-SDR.
Listening for the packets using:
rtl_433 -s 1000000 -X "name=new,m=FSK_PCM,s=25,l=25,r=100" -S All (-s 250000 not enough)
I got similar data to BMW Gen5 and I manage to rewrite decoder to suit Audi etron (Autel, but original is Huf).
bitbench

Would you like to rewrite BMW_Gen5 to include Audi (with if, else, case) or it is better to create new device for this brand?
https://github.com/Gucioo/rtl_433/blob/master/src/devices/tpms_audi.c

[ProfBoc75]

@Gucioo: Thanks for your finding !

Yes, I can update later this week the existing decoder to take into account the specific brand with shorter message without the 3 flags.

[ProfBoc75]

Done, last version should decode Audi TPMS, don't hesitate to give feedback here.

[Gucioo]

I wasn't quick enough to get back to you with the latest finding, but Audi seems to be a bit specific with TPMS implementation.

BMW and Audi responds different on different trigger.

https://imgur.com/a/9JH5Iir
BMW:
sends 26 hexes and ID=03 regardless how it was triggered. [11 bytes after preamble]
Audi:
1 - If was triggered by Autel Read it sends the same 26 hexes with MM id=88 [11 bytes]
2 - when triggered by inflate/deflate, it sends only 20 hexes with MM id=00 [8 bytes]

21:28:04.271 -> Timings....
21:28:04.271 -> CD_Width=0
21:28:04.271 -> TimingsIndex=158
21:28:04.271 -> Checking complete. Bitcount: 202  StartDataIndex: 26
21:28:04.366 ->  [88]  [20]  [C0]  [74]  [57]  [1]  [4C]  [E3]  [9]  [9A]  [29] 
21:28:04.557 ->  [88]  [20]  [C0]  [74]  [57]  [1]  [4C]  [E3]  [9]  [9A]  [29] 
21:28:04.605 -> CRC Check OK
21:28:04.605 -> Pos:    Manuf ID: Undefined(0x88)   ID: 20C07457   Flags1: 0xE3   Flags2: 0x9   Flags3: 0x9A   Temperature: 24.00   Tyre Pressure: 0.36 (psi)  2.45 (kpa)
21:28:04.605 ->   Low Pressure warning.  Limit: 30.00 [30.41]  Measured: 0.36

During normal operation (in motion) Audi sends 11 bytes with id 88, when it gets sudden pressure loss it sends 11 bytes with id 88. Some exception would be needed to cover this changing length.

When there is sudden pressure loss, it burst frames each second, maybe thats why they decided to reduce message length, to save on energy, but who knows?!
https://imgur.com/a/wKUPGlo

I've also noticed the same sensor is used with A3, may be worth adding to header.

// Audi E-tron 01/2018-12/2023(433Mhz)
// Audi A3 06/2012-12/2023(433Mhz)8L
// OE No 2N0907251 - Huf/Beru RDE018

I would like to thank JSMSolns for his help to implement this protocol that he made under his Arduino TPMS Tyre Pressure Display.

[Gucioo]

Done, last version should decode Audi TPMS, don't hesitate to give feedback here.

It works fine now. -s 1000000 is required to decode properly, on standard sampling rate is not working.

The only thing, it would require ID update according to my previous comment:
0x88 brand: 136 - Audi in motion [11 bytes]
0x00 brand: 0 - Audi/possible others? in sudden deflate/burst mode [8 bytes]

rtl_433 version 23.11-104-g2c1967f4 branch master at 202404102250 inputs file rtl_tcp RTL-SDR
MQTT: Publishing MQTT data to 192.168.999.999 port 1883
MQTT: Publishing events info to MQTT topic "rtl_433[/model][/id]".
Use "-F log" if you want any messages, warnings, and errors in the console.
Detached kernel driver
Found Rafael Micro R820T tuner
Exact sample rate is: 1000000.026491 Hz
[R82XX] PLL not locked!
Allocating 15 zero-copy buffers
{"time" : "2024-04-10 21:26:49", "model" : "BMW-GEN5", "type" : "TPMS", "brand" : 136, "id" : "20c07457", "pressure_kPa" : 2.450, "temperature_C" : 25.000, "flags1" : 228, "flags2" : 9, "flags3" : 154, "msg" : "8820c07457014de4099ab6", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:05", "model" : "BMW-GEN5", "type" : "TPMS", "brand" : 136, "id" : "20c07457", "pressure_kPa" : 2.450, "temperature_C" : 25.000, "flags1" : 228, "flags2" : 9, "flags3" : 154, "msg" : "8820c07457014de4099ab6", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:54", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 26.950, "temperature_C" : 25.000, "msg" : "0020c074570b4dda", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:55", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 29.400, "temperature_C" : 25.000, "msg" : "0020c074570c4d1b", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:56", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 26.950, "temperature_C" : 25.000, "msg" : "0020c074570b4dda", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:57", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 26.950, "temperature_C" : 25.000, "msg" : "0020c074570b4dda", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:58", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 26.950, "temperature_C" : 25.000, "msg" : "0020c074570b4dda", "mic" : "CRC"}
{"time" : "2024-04-10 21:27:59", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 19.600, "temperature_C" : 25.000, "msg" : "0020c07457084dce", "mic" : "CRC"}
{"time" : "2024-04-10 21:28:00", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 4.900, "temperature_C" : 25.000, "msg" : "0020c07457024db6", "mic" : "CRC"}
{"time" : "2024-04-10 21:28:01", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 2.450, "temperature_C" : 25.000, "msg" : "0020c07457014da2", "mic" : "CRC"}
{"time" : "2024-04-10 21:28:02", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 2.450, "temperature_C" : 25.000, "msg" : "0020c07457014da2", "mic" : "CRC"}
{"time" : "2024-04-10 21:28:03", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 2.450, "temperature_C" : 25.000, "msg" : "0020c07457014da2", "mic" : "CRC"}
{"time" : "2024-04-10 21:28:06", "model" : "Audi", "type" : "TPMS", "brand" : 0, "id" : "20c07457", "pressure_kPa" : 2.450, "temperature_C" : 25.000, "msg" : "0020c07457014da2", "mic" : "CRC"}

[ProfBoc75]

@Gucioo : Very interesting ! My update is still valid but yes for this specific situation of fast deflating, and probably related to the behavior of this kind of sensor than to Audi.

In my street scanning, I found one message with 0x88, unknown until now, so I will update the decoder with this brand link to Audi.

I will check also JSMSolns projects to see if we have some other findings there and may be some answers related to the flags we didn't guess for BMW.

Edit: JSMSolns likes also rtl_433 😄 .... for you Christian @zuckschwerdt

Acknowledgements
I'd like to acknowledge the work done by the RTL_433 team (in particular Christian W. Zuckschwerdt)

[ProfBoc75]

@Gucioo:

To summarize:

• Short Message = Audi Pressure Alert, sudden pressure increase or decrease, Brand ID = 0x00, send every seconde.
• Long Message , no Change, just Brand ID = 0x88 = Audi

I'm preparing an update to the decoder and will commit soon.

[Gucioo]

@Gucioo:

To summarize:

• Short Message = Audi Pressure Alert, sudden pressure increase or decrease, Brand ID = 0x00, send every seconde.
• Long Message , no Change, just Brand ID = 0x88 = Audi

I'm preparing an update to the decoder and will commit soon.

Yes, that's correct.

[luki343]

Does this sensor need to receive any data to start sending pressure and temp?
I'm thinking about making simple arduino board to receive data from tpms and send it via CAN to my standalone ECU to have possibility to log this data.

[ProfBoc75]

@luki343 Depends on brand model and the behavior could change between static / parked situation where the sensor is in standby mode to preserve the battery and from moving where the sensor can also send some kinetic information into one of the 3 flags.

You may be interested in this Arduino project which is already handle BMW model. You may have to cross check if they updated it with our last update with Audi model and Audi pressure alert.

[luki343]

@ProfBoc75
I know it depends on the sensor, which is why I'm asking about this particular TPMS. I thought maybe someone who sniffed this sensor found something sent from the car to the sensor.

I need to adapt some TPMS to my "race car" and send it to ECU via CANbus, so the easiest way will be to use one of the currently decoded sensors, but if it needs to receive some message from car, I'm lost.
On second car (daily, renault), I have factory TPMS (0435r) and from what I sniff myself it just sends data and nothing receive, it don't even need to be activated after mount in wheel, it activate automatically after some distance and you only need to code ID to car and thats all.
I would prefer to use this BMW sensor (continental version more precisely) instead of Renault.

I will definitely check out this project, thx