rtl_433
rtl_433 copied to clipboard
merbanan
Has someone experience with Tire Moni/Tyredog TPMS sensors?
Hi, I'm using Tire Moni TD-1000 TPMS sensors. These sensors are the same as the Tyredog sensors. These sensors are using FSK modulation (yellow label). Does anyone perhaps have experience with reading this type of sensor? BR Lodewijk
TPMS data mostly looks the same: 50 µs FSK Manchester. Grab a sample, inspect, upload here as zip, see https://triq.org/rtl_433/ANALYZE.html We can then pick the data apart.
analyse_20220918_2146.zip Hi, in this example the pressure
- start with 1,65 bar
- after ~4-8 sec drops to 0,86 bar
- after 2 sec drops to 0,62 bar
- after 4 sec drops to 0,00 bar hope this is enough? BR Lodewijk
Run -A and open one of the pdv links. You'll see:
- 50 µs data rate
- 18 preamble bits
- a desync of 150 µs
- ~16 data bits
This should work: -X 'n=name,m=FSK_MC_ZEROBIT,s=50,l=50,y=150,g=150,r=200' but doesn't, the desync gets in the way I guess.
But that is too little data in a single packet. And there are too much packets. We have seen this once before, each byte of the transmission could be in it's own packet.
Might be better to look at the raw PCM to verify. -X 'n=name,m=FSK_PCM,s=50,l=50,y=150,g=150,r=200,preamble=5553'
With the preamble match of 5553 and MC in the and we get a nice pattern in this BitBench.
Looks like 2 fixed bits (still part of the preamble/sync) and then two bytes.
I've marked a few blocks and the second nibble seems to count, but the start and sequence or data part is not really obvious.
Hi, is this really FSK? If I open your samples in Audacity it is looking strange.
The first one in the picture is a Bresser Sensor with FSK. The second one is your second file and it look completely different. @zuckschwerdt am I right that it does not look like FSK?
The packets are tiny and many. In the broad overview packets might look like OOK. But zoom into one packet and you see two frequencies, one close to DC:
You can also use the spectrogram of https://triq.org/pdv/ and spot two freqs, offset by 50kHz (the red marker is DC):
I've also made a dump of the second sensor. I only have two sensors because I'm using these sensors for my caravan. Regarding also the yellow label on this second sensor, I expected the same type of modulation. However it seems different from sensor 1, but I cannot determine which modulation it is. Can you help again? analyse_sensor2_20220922.zip
Hi ,you capture more than only your sensor, like file g002_433.92M_250k.cu8 is a inFactory-TH. g001 contains your sensor, g004 nothing, g005 your sensor, g006 nothing, g007 your sensor, g008 nothing g009 nothing.
According to the manual of your sensor, your sensor can also detect the temperature. So we should find in the data of your sensor the temperature. According to the inFactory-TH it was 52,5 F (~11 Celsius). When you record the data, was your caravan also outside? So we can search for the temperature of ~ 52,5F in the data ?
I have to say that I am not a expert and I try to learn how to decode the data, sorry for the silly questions.
@franki29 to summarize: decode raw PCM and use MC and format in a BitBench as above. Then find the 10 packets of each message (presumed), the first nibble and last byte should be data and checksum (not sure which is which). The result looks like this:
d-32 9-79 c-a8 c-5c b-ad a-32 b-76 e-2d e-51 e-c1 d-a9
d-32 9-79 c-a8 c-5c b-ad a-32 b-76 e-2d e-51 e-c1 d-a9
d-32 9-79 c-a8 c-5c b-ad a-32 b-76 e-2d e-51 e-c1 d-a9
d-32 9-79 c-a8 c-5c b-ad a-32 b-76 e-2d e-51 e-c1 d-a9
d-32 9-79 c-a8 c-5c b-ad a-32 b-76 e-2d e-51 e-c1 d-a9
d-32 9-79 c-a8 c-5c b-ad a-32 b-76 e-2d e-51 e-c1 d-a9
d-32 9-f9 b-2f c-dc b-2d a-b2 b-76 e-2d e-51 d-c8 a-ae
d-32 9-f9 b-2f c-dc b-2d a-b2 b-76 e-2d e-51 d-c8 a-ae
d-32 9-f9 b-2f c-dc b-2d a-b2 b-76 e-2d e-51 d-c8 a-ae
d-32 9-f9 b-2f c-dc b-2d a-b2 b-76 e-2d e-51 d-c8 a-ae
We will need a ramp of values (like pressure slowly changing) over 5 to 10 minutes. That way we get a steady progression of values changing and can spot the data fields (mostly changing by 1 each time) and checksum (changing randomly).
@franki29 no silly questions :). But you're right, these sensors are registring both temperature and pressure. The TPMS sensors are during the tests only inside my house. Temperature of a sensor during pressue measurement is ~21-23 degr C. The inFactory-TH is somewere outside (at one of my neighbors).
@zuckschwerdt Concerning the pressure: I understand what you mean with a ramp of values. However testing with slowly changing the pressure downwards is allways going in steps of ~ 0,2 bar lower (as far as I can see on the Tire Moni display). The timing of the rtl_433 output is always in time sync with the change on the Tire Moni display. pre-conclusion: pressure changes are only measured in steps of ~0,2 bar. Changes are send directly.
Concerning the temperature: Changing the temperature of the sensor will allways take ~30-60 seconds before the temperature on the display is updated. So I assume the temperature sensor is only sending it's changes periodic.
Using the options -X 'n=name,m=FSK_PCM,s=50,l=50,y=150,g=150,r=200,preamble=5553' is only registering the changes of the pressure. Changes of temperature are not registered with these settings (even without preamble).
Therefore I've run the -A unknown while changing the sensors temperature by using a hairdryer. See uploaded files (special at g005_433.92M_250k.cu8). For me it looks like the temperature data isn't modulate by using FSK but by using ASK modulation. Can you confirm this? And which -X settings are needed to read these temperature data?
All in all these sensors seems very complicated to read, compared to other vendors. However I hope you can help me a bit further again.
ps Tire Moni seems a brand of Tyredog. Same devices.
Hi a8193, g005 is again the inFactory-TH Sensor. Try rtl_433 -r g005_433.92M_250k.cu8
Hi a8193, can you tell me the pressure of the "heated" sensor? It looks like you still get data not only from one sensor.
Hi a8193, I am guessing that g001.. and g004 are two different sensors. Is it possible to get some data from only one sensor by removing the antenna of your receiver and record some data close to your sensor?
Maybe I am totally wrong, but the last data you send are very close to the ford sensors. I modified the Ford sensor decoder in RTL_433 and get some data, that looks not bad, but I am not sure if the data that I can see are correct. At least I can see two ID's with different pressure and one with Temperature and one without.
As I already told, I am not a expert and try to learn, I can be at the "wooden way" as we say in Germany (so totally wrong) Br.
The two working samples from 20220924-sensor3-temp1.zip have the same timing but much longer packets. They read:
aaaaaaaaa9caaacaccb32acaad2b4cb4cb53534acd3332b53328
aaaaaa72aab3552d2ab34d4cad54d2d4d4d2b34cccad4acd0
which MC decoded is:
808a50831a69dd8b54750
80be60b747d9dd8b54713
but from just two codes it really is not visible where the fields are. If we assume the ID in the first bits then these must be different sensors (or maybe the data is encrypted).
Hi a8193, g005 is again the inFactory-TH Sensor. Try rtl_433 -r g005_433.92M_250k.cu8
I know, this sensor is somewhere in the neighbourhood. How can I ignore this sensor within my tests?
@franki29 and @zuckschwerdt Every measurement I've been done was always only with one sensor. As said I've only two sensors and the not-used sensor is always wrapped in aluminium foil and therefore 'invisible' so it's always one sensor which can be seen. I'll do some new tests for each sensor with lowering pressure and a test with changing temperature. I'll write down the value on the Tire Moni display with each change. I'll upload these files when done. BR Lodewijk
You can use -R 0 -X 'n=tyredog,m=FSK_PCM,s=50,l=50,y=150,g=150,r=200,preamble=5553' and you will only see the TPMS codes. Just post those codes then.
Hi, hereby an additional test for each sensor while decreasing the pressure slowly.
test sensor P_bar T_dC P_psi T_dF pck00 pck01 pck02 pck03 pck04 pck05 pck06 pck07 pck08 pck09 pck10
11-1 #3 1,96 26 28,42745 78,8 | d-32 d-39 a-88 8-1c f-8b b-0e b-76 e-2d e-51 9-9f a-d3
11-3 #3 1,41 25 20,45036 77,0 | d-32 9-79 f-d8 d-ec c-d3 f-ce b-76 e-2d e-51 8-87 b-eb
11-4 #3 1,17 25 16,96945 77,0 | d-32 d-b9 a-1f a-bc 8-13 b-8e b-76 e-2d e-51 8-9e d-fc
11-6 #3 0,00 24 0,00000 75,2 | d-32 d-39 8-c2 d-6c c-9f b-0e b-76 e-2d e-51 f-9d e-fd
1 #3 0,00 23 0,00000 73,4 | d-32 e-c9 b-3e b-4c 8-31 f-b7 b-76 e-2d e-51 f-60 8-06
21 #3 0,00 23 0,00000 73,4 | d-32 9-79 c-82 b-cc b-a5 a-32 b-76 e-2d e-51 a-63 e-1b
12-1 #4 2,17 25 31,47325 77,0 | e-33 c-12 a-ea 9-0e 9-41 c-43 a-75 d-77 f-61 b-37 c-99
12-2 #4 1,86 25 26,97707 77,0 | e-33 8-d2 f-a3 e-5e d-01 8-83 a-75 d-77 f-61 9-08 a-80
12-3 #4 1,69 25 24,51142 77,0 | e-33 8-52 f-3a b-ae d-81 8-03 a-75 d-77 f-61 8-07 9-e9
12-4 #4 1,34 25 19,43509 77,0 | e-33 8-52 f-32 9-8e d-81 8-03 a-75 d-77 f-61 e-6f f-c1
12-5 #4 1,10 25 15,95418 77,0 | e-33 8-d2 f-c9 a-1e d-01 8-83 a-75 d-77 f-61 d-66 e-aa
12-6 #4 0,86 24 12,47327 75,2 | e-33 8-52 e-40 f-6e d-89 8-03 a-75 d-77 f-61 c-65 a-5b
12-7 #4 0,00 24 0,00000 75,2 | e-33 9-62 a-6a f-ee d-89 8-03 a-75 d-77 f-61 e-ef f-c1
23 #4 0,00 23 0,00000 73,4 | e-33 f-c2 8-bb c-3e d-63 8-83 a-75 d-77 f-61 d-22 c-8a
24 #4 0,00 23 0,00000 73,4 | e-33 c-92 a-17 b-2e f-cf c-c3 a-75 d-77 f-61 c-1a 8-4a
in the above table I've presented testset 11 (with sensor 3) and 12 (with sensor 4). The columns are: test = my testnumber sensor = sensor number (I only have 2 sensors, marked as sensor 3 and 4) P_bar = pressure in bar according the Tire Moni display T_dC = temperature in degrees Celsius according the Tire Moni display P_psi = calculated pressure in psi (= bar * 14,5038) T_dF = temperature in degrees Fahrenheit (= (T_dC * 1,8) + 32 pck00 - pck10 = the packets are allways in the format: "10 n p# bb" where n = nibble p# = packetnumber, 00 - 10 bb = byte This results for instance for test 12-6 is in the sequence:
10 e 00 33
10 8 01 52
10 e 02 40
10 f 03 6e
10 d 04 89
10 8 05 03
10 a 06 75
10 d 07 77
10 f 08 61
10 c 09 65
10 a 10 5b
All these tests are generated by only changing the pressure for the respective sensor. Changing the temperature results in a different packetform as above mentioned (longer).
In the above table only the nibble and byte are represented, seperated by a hyphen. My conclusions so far:
- This data is only generated when the pressure changes. When changing the temperature there is a different dataformat send.
- For each sensor the data of packet00/06/07/08 is always the same for a sensor.
- Furthermore the second nibble of the byte in packet 01/03/05 is always the same for a sensor.
- with pressure 0 and equal temperature the data is different
- there seems no logical increment/relation between the different measurement
- therefore it seems logical this data is encrypted or encoded somehow
Some other suggestions to break this 'chaos'?
BR Lodewijk
test11-sensor3-pres - part1.zip test11-sensor3-pres - part2.zip test12-sensor4-pres - part1.zip test12-sensor4-pres - part2.zip
Because of the layout of the testresults also a txt-file with this text result test11 and 12.zip
Hi Lodewijk, great work. While you had a look at the data for pressure change, I had a look at the other data. It looks like the have the same amount of data. Here the bitbench for all data that I have found
The problem I have: the packages pck06 pck07 pck08 seems to be the ID for sensor 1 in your result text seems to be b-76 e-2d e-51 = 762d51 In the data that I have send to bitbench Sensor 1 has: 9d8b54
So I do not know what we need to do to match the data, but it looks like that the data packages have same lengths, no matter how the sensor sends the information.
Shure that @zuckschwerdt can help out
Br. Frank
Hi Lodewijk, one more question: For sensor 4, did you warm up the sensor with a hairdresser or something else? Br Frank
As it seems the Tire Moni sensors have a different dataformat for pressure and for temperature, I've also done some additional testing by only changing the temperature. The initial pressure for these tests is about 1 bar but is changing a little bit due to increasing the temperature. This has something to do with the law of Boyle-Gay Lussac (PxV)/T=C and some additional thermo dynamic rules. These tests are done with the respective sensor in a pressure sprayer (for the 1 bar pressure) and using a hairdryer for heating up the pressure sprayer and with it also the sensor. Always only one sensor a time is 'visible the second sensor is wrapped in aluminium foil.
The format of the temperature data is, as @franki29 also has mentioned, in the format: AA BB CC DD EE FF GGGGGG HH I
In the cu8-files I've seen the pressure changes were generating codes in the same format as described in my update from 2 days ago.
...
| testnr | sensor | P_bar | T_dC | P_psi | T_dF | AA | BB | CC | DD | EE | FF | GGGGGG | HH | I | Original code |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 32-1 | #3 | 1,00 | 25 | 14,50380 | 77,0 | 80 | aa | 79 | 1b | 25 | f7 | 9d8b54 | 4d | 7 | 5555555554e55566665aa595a69659aa9aa5a9a56699995969aa0 |
| 32-2 | #3 | 1,07 | 27 | 15,51907 | 80,6 | 80 | ba | 68 | 93 | 31 | e7 | 9d8b54 | 59 | 6 | 5555555554e55566a65a6565969695aa5aa5a9a566999959a59a4 |
| 32-3 | #3 | 1,07 | 28 | 15,51907 | 82,4 | 80 | ae | 78 | 87 | 2f | f7 | 9d8b54 | 77 | 3 | 5555555554e555666a5aa5655a966aaa9aa5a9a56699995a9a9a0 |
| 32-4 | #3 | 1,07 | 31 | 15,51907 | 87,8 | 80 | ae | 78 | 8b | 29 | f7 | 9d8b54 | 4d | 3 | aaaaaa9caaaccd4b54acacd2ccb55354b534acd3332b2d3340 |
| 32-5 | #3 | 1,07 | 35 | 15,51907 | 95,0 | 80 | 9e | 48 | 9f | 61 | c7 | 9d8b54 | 59 | 0 | aaaaaaa72aab2d52cb2b2d54d2ad4ad52d4d2b34cccacd2ca0 |
| 32-6 | #3 | 1,07 | 37 | 15,51907 | 98,6 | 80 | 9e | 48 | 83 | 6d | c7 | 9d8b54 | 51 | 0 | 5555555554e55565aa596565569a69a95aa5a9a56699995995940 |
| 32-7 | #3 | 1,13 | 40 | 16,38929 | 104,0 | 80 | 8e | 58 | 37 | 67 | d7 | 9d8b54 | 6c | 2 | d555555554e555656a59a5569a9a5aa99aa5a9a56699995a69640 |
| 34-1 | #3 | 1,03 | 26 | 14,93891 | 78,8 | 80 | 8e | 58 | eb | 03 | d7 | 9d8b54 | 77 | 2 | aaaaaa72aab2b52cd2b5334aab54cd52d4d2b34cccad4d520 |
| 34-2 | #3 | 1,03 | 29 | 14,93891 | 84,2 | 80 | 8e | 58 | 6f | 0d | d7 | 9d8b54 | 4d | 0 | aaaaaaa72aab2b52cd2ad354ab4d4cd52d4d2b34cccacb4ca2 |
| 34-3 | #3 | 1,10 | 31 | 15,95418 | 87,8 | 80 | 8e | 58 | 73 | 09 | d7 | 9d8b54 | 45 | 0 | 5555555554e555656a59a55a969565a99aa5a9a56699995959944 |
| 34-4 | #3 | 1,10 | 34 | 15,95418 | 93,2 | 80 | be | 68 | 67 | 43 | e7 | 9d8b54 | 50 | 7 | 5555555554e55566aa5a655a5a9956aa5aa5a9a566999959956a0 |
| 33-1 | #4 | 0,96 | 26 | 13,92365 | 78,8 | 80 | d4 | b3 | 57 | 86 | 54 | dd5dd8 | 52 | 2 | aaaaaaaaa9caaad332cd2d33354ab4b332d3533353534ab32cc8 |
| 33-2 | #4 | 0,96 | 27 | 13,92365 | 80,6 | 80 | c4 | 83 | 7b | b4 | 64 | dd5dd8 | 54 | 2 | aaaaaaaaa9caaad2b2caad354d4d32b4b2d3533353534ab332c8 |
| 33-3 | #4 | 0,96 | 29 | 13,92365 | 84,2 | 80 | c4 | 83 | 7f | b8 | e4 | dd5dd8 | 6f | 0 | 2aaaaaaaa9caaad2b2caad35554d4ad4b2d3533353534ab4d528 |
| 33-4 | #4 | 0,96 | 33 | 13,92365 | 91,4 | 80 | f4 | 93 | 63 | d0 | f4 | dd5dd8 | 78 | 7 | 55555555539555aa65965a695aa655aa65a6a666a6a6956a95a8 |
| 33-5 | #4 | 0,96 | 35 | 13,92365 | 95,0 | 80 | d4 | b3 | 07 | f4 | d4 | dd5dd8 | 70 | 2 | aaaaaaaaa9caaad332cd2d2ab55532d332d3533353534ab52ac8 |
| 33-6 | #4 | 1,00 | 37 | 14,50380 | 98,6 | 80 | d4 | b3 | 3b | f8 | d4 | dd5dd8 | 48 | 2 | 55555555539555a6659a5a5a9aaa95a665a6a666a6a695659590 |
| 33-7 | #4 | 1,00 | 39 | 14,50380 | 102,2 | 80 | d4 | b3 | 3f | fc | d4 | dd5dd8 | 40 | 2 | 55555555539555a6659a5a5aaaaaa5a665a6a666a6a695655590 |
| ... |
in the above table I've presented testset 32 and 34 (with sensor 3) and 33 (with sensor 4). The columns are: testnr = my testnumber sensor = sensor number (I only have 2 sensors, marked as sensor 3 and 4) P_bar = pressure in bar according the Tire Moni display T_dC = temperature in degrees Celsius according the Tire Moni display P_psi = calculated pressure in psi (= bar * 14,5038) T_dF = temperature in degrees Fahrenheit (= (T_dC * 1,8) + 32 AA = byte 1 -> it seems this is always 0x80 regardless of the sensor number BB = byte 2 CC = byte 3 DD = byte 4 EE = byte 5 FF = byte 6 GG = byte 7-9 -> it seems this byterange is unique for each sensor HH = byte 10 I = nibble 21 Original code = from cu8 file (with s=50,l=50,y=150,g=150,r=200)
As far as I can see, nowhere is a logical increasing of data visible between the different tests. Also testresults with the same result are not comparable. I wouldn't be surprised if this data is encrypted. How can we try to decode this?
Hi Lodewijk, so for me it looks like the second data format that I was looking at might work. At least for the ID , Pressure and Temperature. It could be that the formula for pressure and temperature are not OK. Please try the second test decoder and compare it with the display of your receiver.
For test11 :
model : Tire Moni type : TPMS id : 9d8b54 Pressure : 0.55 Bar Temperature: 22.0 C
model : Tire Moni type : TPMS id : 9d8b54 Pressure : 0.00 Bar Temperature: 18.0 C
For test12
model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.55 Bar Temperature: 41.0 C
model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.55 Bar Temperature: 37.0 C
model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.41 Bar Temperature: 18.0 C
Br. Frank
I update the Bitbench and hope that this are the right values. CRC is missing and other possible values like moving yes/no
@franki29 I'm afraid your format isn't the right one. In my table you can see there is no direct relation between de values in column T_dC (which are incrementing within every test) and column HH, which seems to change randomly.
btw In the table from 4 hours ago I've added a column with the original values from the cu8 files.
Hi Lodewijk, so for me it looks like the second data format that I was looking at might work. At least for the ID , Pressure and Temperature. It could be that the formula for pressure and temperature are not OK. Please try the second test decoder and compare it with the display of your receiver.
For test11 :
model : Tire Moni type : TPMS id : 9d8b54 Pressure : 0.55 Bar Temperature: 22.0 C
model : Tire Moni type : TPMS id : 9d8b54 Pressure : 0.00 Bar Temperature: 18.0 C
For test12
model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.55 Bar Temperature: 41.0 C
model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.55 Bar Temperature: 37.0 C
model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.41 Bar Temperature: 18.0 C
Br. Frank
How do I add this c-file to my rtl_433 config? btw I'm running rtl_433 in a docker container BR Lodewijk
Hi Lodewijk, one more question: For sensor 4, did you warm up the sensor with a hairdresser or something else? Br Frank
In test11 and test12 I've only increased the pressure. However this often influences the temperature a little bit. BR Lodewijk
Hi Lodewijk, so for me it looks like the second data format that I was looking at might work. At least for the ID , Pressure and Temperature. It could be that the formula for pressure and temperature are not OK. Please try the second test decoder and compare it with the display of your receiver. For test11 : model : Tire Moni type : TPMS id : 9d8b54 Pressure : 0.55 Bar Temperature: 22.0 C model : Tire Moni type : TPMS id : 9d8b54 Pressure : 0.00 Bar Temperature: 18.0 C For test12 model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.55 Bar Temperature: 41.0 C model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.55 Bar Temperature: 37.0 C model : Tire Moni type : TPMS id : dd5dd8 Pressure : 0.41 Bar Temperature: 18.0 C tpms_tiremoni.zip Br. Frank
How do I add this c-file to my rtl_433 config? btw I'm running rtl_433 in a docker container BR Lodewijk
Hi Lodewijk, I am using a Laptop with Linux and cloned the git repository. I am not using a pre build version. For your docker container I do not know how to do. I would recommend to read the https://github.com/merbanan/rtl_433/blob/master/docs/BUILDING.md where you can find the way to build the newest version. At https://github.com/merbanan/rtl_433/wiki/Decipher-a-new-device-and-write-a-decoder#declare-the-new-decoder-to-rtl_433-in-includertl_433_devicesh you find how to add a new decoder, in my case I had to add 'DECL(tpms_tiremoni) \ ' in the file include/rtl_433_devices.h and "devices/tpms_tiremoni.c" in the file src/CMakeLists.txt. I have no file src/Makefile.am so I did nothing there. After recompiling with 'make' in the folder ../rtl_433/build and 'sudo make install' the decoder will be added. This might not work if you already installed a rtl_433 version, but you find a compiled version after you did the 'make' under ../rtl_433/build/src. that can be executed with ./rtl_433
Hi Frank, no I didn't. Was on a holiday last week 😀. However looking to the results you've seen and uploaded, they didn't match with my measurements in both tests 11 and 12. So i don't expected serious results. Nevertheless I'll give it a try next week BR Lodewijk