SDR Listens In To Your Tires

[Ross] has a 2008 Toyota Tacoma. Like many late model cars, each tire contains a direct tire pressure monitoring sensor or TPMS that wirelessly sends data about the tire status to the car. However, unlike some cars, the system has exactly one notification to the driver: one of your tires is low. It doesn’t tell you which one. Sure, you can check each tire, but [Ross] had a different problem. One sensor was bad and he had no way to know which one it was. He didn’t have any equipment to test the sensor, but he did have an RTL-SDR dongle and some know-how to figure out how to listen in on the sensors.

The key was to use some software called RTL-433 that is made to pick up these kinds of signals. It is available for Linux, Windows, or Mac, and supports hundreds of wireless sensors ranging from X10 RF to KlikAanKlikUit wireless switches.

The program successfully found three of the TPMS sensors and helpfully decoded the information they were sending. It seems the bad sensor was totally dead. Since the transmitters are extremely low-power, it was easy to move the antenna close to each sensor to identify which one was not transmitting. We aren’t sure if the transmitter was dead, or if it was just unable to send proper packets. If it was actually dead, a field strength meter might have found it. However, at such low power levels, the method [Ross] used might have been easier.

Besides, you probably have an RTL-SDR hanging around and are less likely to have a field strength meter. Not that you couldn’t make one with a germanium diode and a sensitive voltmeter, but still.

We’ve always been impressed with the homemade TPMS we’ve seen. We’ve also seen RTL-433 adapted to read medical devices.

26 thoughts on “SDR Listens In To Your Tires

  1. Nice, I don’t suppose anyone has come across info on programming the damn things? I have an early TPMS system, where all the spares are gonna have dead batteries anyway, and be a damn nuisance… then the tire shop approach is to use “universal” TPMS modules that they swear they can program to your car, the problem with that is that I have a 2 way system, I can set the sensors. I don’t think the universal ones are 2 way once installed, think they only respond to the proprietary programmer, so you don’t get to have winter and summer tire pressures, or high load and normal. (Chrysler specify high pressures for heat, speed or max load) Then there’s 3 at least competing systems with different proprietary programmers… Now… I also have a set of tires/wheels, came off another vehicle, that have the $100 a pop some kind of universal TPMS units in them, and I’d like to screw with them to see if there’s a hope in hell of getting them on my other vehicle, and being able to program pressure cutoffs or not.

    The annoying thing is this system was a de luxe item on this model and maybe not ready for primetime, several years before TPMS became compulsory, but current “inspection” regs say that if it exists on the vehicle it must work *sigh* … so it’s basically a “toy” system that’s been promoted to “essential safety device” apparently, and keeping the stupid thing workable is a huge ass pain.

    1. Best option in your case is to code it out, I did this on an older Bentley just last month, it’s fairly common on euro stuff (here in the UK) I wouldn’t know where to begin on USA stuff but it must be possible.

    2. The kinda vague TPMS standard supposedly dictates that the sensors are dumb and basically only broadcasts pressure (and optionally the air temperature) inside the tire to anything that requests it.
      Though the universals are sometimes programmable in the sense that you can set their ID code, as each sensor is supposed to have a unique ID code.
      Though with OEM sensors, you have to “tell” the TPMS control box it needs to monitor this set of TPMS ID codes.

  2. Semi-Tangent:
    There are several companies that use a web of roadside TPMS-sensor-sensors to collect “traffic” data.

    About 7(? time is hard at this point…) years ago I started seeing little boxes attached to the utility poles in my city at just above curb-height.
    I thought that was weird, and a few weeks later I happened to see a contractor installing one while at a stop-light on the way home. The box was open, and my brain immediately said “Radio” and “Commodity Hardware”. So I pulled over and started talking to the guy. “Cool stuff in a box” often makes for an interesting conversation.

    It turned out that his company was being contracted to install these boxes on pretty much every pole in the city by some generic sounding company. He wasn’t exactly sure what they were for, and he was kind enough to show me the guts of one.

    A raspberry Pi.
    A cellular hat.
    2 panel antenna labeled 315 & 433MHz pigtailed to USB sticks.
    A solar panel, lead-acid battery, and a charge controller/converter.

    He just had to “Plug it & Snug it”. Then he waited until he got the green-light from his tablet. (Guessing some management software that pings a server or establishes command and control?)

    It took me a while (months of casual searching) to figure out that these boxes were recording groups of TPMS identifiers and times, which were then sent to some central database.

    Our city was paying them for something. Nominally “traffic data” but I never followed through with a full FOIA request.

    These were/are permanent boxes.
    They are owned and operated by a 3rd party.
    There was pretty much no oversite that I could find.

    Think about that for a minute.
    With that dataset you can track the location of any car backward in time, with accuracy in the seconds.

    So this just ends up being another creepy footnote about data aggregation utterly destroying privacy by de-anonymizing data.

    This is why we need new privacy laws that drag our IDEA of privacy, and the REALITY of privacy at least into the same room.

    People seem to at least get a little uncomfortable at the idea of a policing agency being able to purchase access to live-video feeds from 10,000 doorbell cameras spread across a city. On a whim. With no justification needed. And maybe/maybe-not using them in discriminatory policing actions.

    But it also feels like people are actively choosing not to even think about the few-dozen companies that exist solely to vacuum up as much data as possible so they can aggregate it and create NEW data.

    I don’t know about you, But I happen to find

    Last, First
    Address
    Social Security / Gov. ID

    to be less “Personally Identifying” than

    [Generic ever-present video surveillence]
    Height
    Weight
    Biometric Gait Identifier

    [Stores tracking phones location with in-aisle sensors]
    [Stores ALSO having video footage available]
    [Anything and everything physical/internet shopping related]
    [Loyalty cards! WOOOOO]
    Preferred Pants Brand
    How Long I lingered in the Snack Isle at the store
    Estimated calorie/nutritional intake

    [TPMS]
    What Make/Model Car I drive.
    Where I drive it, and when.
    Work Location
    Sleep Location
    Known Social Links by Proximity/Time

    [Easily guessed by your water usage]
    When I shower, use the toilet, wash the dishes, do my laundry

    And on.
    And ON.

    How long until my medical/life insurance goes up in price because some consulting company sleazes their way into a contract using some unproven algorithm that decides I’m a statistically higher risk to my carrier because I purchase X food Y often, drive Z route to W store and spend K minutes higher than average in the aisle that sells P and S?

    Or worse…if my rates change because being a relative of someone with M/N/O/P habits. Even historic ones.
    (Ever read the fine print on one of those “Prescription Discount Cards”?)

    How awesome is it going to be when Sally and Rajesh pay a 9.144% premium because one of their Grunkles was prescribed blood-pressure medicine, bought bird food regularly, and lived orthogonal to a red house?

      1. I am sick of people like you who don’t see those massive problems with data collection and processing. Ian is completly right, it becomes worse each day. Just look where China already is. Soon in $your_country too! And don’t tell me that it is against law, laws can be changed anytime and will be changed or simply ignored. Just use the magic word “fight against terrorism/covid/pedophiles/…” and everybody will agree with the politicians without even thinking.
        Just for clarification: terrorism, covid and pedophiles are real and horrible problems, but they are often used as a pretext for even more surveillance and data collection. This is not good.

        1. Data collection is a considerably lower risk to me politically then the type of conspiracy theorist who will vote a lunatic into office because they believe they’re fighting against such things.

          Any public data will get collected. To believe anything else is naive. To believe it’s anything new, ditto.

          1. Just to clarify: I don’t vote for “a lunatic” neither i do believe in crazy theories. But as you said, any public (and non-public…) date will be collected and used. I agree that conspiracy-stuff is a big risk, but data collection is also a big risk in my opinion, not a low risk as you say.

    1. they( #78526 ) use it to profile and gather every and all information to hold against you if the need should ever be. it’s very hard to feed the beast wrong information ;) it has to be consistent so as to not be seen as an anomaly. As for the people that say if you haven’t done anything why worry, please go back to your regular scheduled activity there is nothing to see here, the world is rainbows, sunshine and unicorns and since humans are assumed inherently good that must mean good prevails. (feeding the “ad” beast can be fun, my ad profile thinks I’m a gay minority woman who is middle age with an income of 70-80grand, lol living large.) interestingly enough john Oliver just did a piece on data collection. that’s for those who underestimate the mass amount of information maybe check that episode out for a summary. this isn’t an issue of turning right or left its a concern any direction you choose tl;dr I like the post

  3. I use it since years, as I was tired of changing battery of the weather station.
    I let my neighbors take care ;)
    The protocol options are amazing, try shifting the base frequency and look what’s around.
    You can also catch medic data they send from emergency car to hospital in advance…

  4. > “Since the transmitters are extremely low-power, it was easy to move the antenna close to each sensor to identify which one was not transmitting.”

    My experience is that modern TPMS sensors can be read at ~10 meters and even through walls. At least from the small selection of Ford and Toyota cars I’ve tried this with.

  5. Another option is to read from the CAN bus — though unfortunately, TPMS isn’t part of the OBDII standard data set.
    My 2004 Mazda RX-8 similarly has hardware TPMS and only a dummy light, but I managed to get the PSI of each corner.

    I plugged an OBDII->serial over USB adapter into my computer and read the data steam coming from it. I was able to decode a bunch of the proprietary data, which allowed me to collect data while driving (specifically for track days).
    I got steering wheel position, throttle position, brake/e-brake status, speed & RPMs, tire pressure for all four corners, and a bunch more.
    Identifying the tire pressure data required me to let the air out of each tire one at a time while data logging so I could see what changed, but the data’s there!

    For those who are interested, I have the code up here: https://github.com/JessMorgan/car-data-logger

  6. Well this is timely, I just replaced all 4 tires and 4 pressure sensors on my 2007 Tacoma. After 2 weeks, the dashboard tire sensor warning came on. Planning to take back to the tire store, but now will get out my RTL-SDR and investigate first.

  7. I’m surprised that so many cars (in the USA?) have ‘real’ Tpms. My 2012 VW group car just uses the ABS rings to determine an inequality across the axle. Which is demonstrably useless on the low profile tyres the car shipped with. I had a blowout at motorway speed, and only noticed because of the change in road noise. No warnings given. Not even after the fact!

    1. Had a slow (matter of hours, did check pressures just that morning) puncture from a cracked valve stem(?) on a 2013 Golf VII. The ABS based system warned about it and when checked the broken tire was 0.3 bar down. I feel that that is quite sensitive.
      Naturally direct pressure sensing is better, but “free” is hard to beat.

  8. That’s weird timing, I have a 433 RTL plugin running on my homebridge setup & just noticed it logging out a “Toyota” message with a pressure reading yesterday.

    I was wondering what it was & now I know.

  9. I read about someone tired of the hassle of tpms. Bought a 1ft pvc pipe and some caps. Put a tire valve on it. Put all the sensors inside. Pumped it up to 35psi. Tossed it behind the seat. Never got another warning from them

  10. TPMS system is invention of devil and I say that as a person working with them constantly as I work with cars. “every” car is different and there are better ways to do same thing. Good system is like previous generation BMW:s, which tell if your tire is going flat without any extra parts in your tires, it works reading wheel speed from abs sensors, which you already have anyway. For working with these sensors, I have to have 4 different machines to be able to diagnose and program TPMS in most of the cars out here. 1 or 2 machines should be enough (EURO + US bands) but those sensors are so temperamental, often one machine reads them and another one don’t, even if they should work on both. There is constantly very much problems from these. Main issue being dead batteries, which cannot be changed (but many hacker can actually change if they want, if they first get tires out from rims). Others pay roughly 80-90EUR for one new sensor fitted. Another very common problem is early generation GM sensors, valve stems corrode away and start to leak. And when you have new sensor fitted, relearning procedure is different for every car, some cars find new sensors themselves after driving few km, others need black magic and full moon before they start to work properly. Also one big problem is some sensors having very high range in them, its sometimes hard to operate with these when you are not sure what sensor you are reading or writing, it is not necessary the one nearest in your hand, it could be the one on another side of the garage or under another car.. If you have mandatory winter tire season, like in here Finland, you can double your cost and effort caused by TPMS.

Leave a Reply to Jess MorganCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.