Subaru Outback - Subaru Outback Forums

Subaru Outback - Subaru Outback Forums (https://www.subaruoutback.org/forums/)
-   Gen 5: 2015-2019 (https://www.subaruoutback.org/forums/138-gen-5-2015-2019/)
-   -   Spoofing TPMS signal (https://www.subaruoutback.org/forums/138-gen-5-2015-2019/490273-spoofing-tpms-signal.html)

Brucey 05-16-2018 11:13 AM

Spoofing TPMS signal
 
Spawning off this thread:

https://www.subaruoutback.org/forums/...-yet-tpms.html

I decided to go ahead and create a new thread since the 'pipe bomb' is now proven not to be a viable solution.

For a quick recap: I have 12 tires (3 sets of 4) that I change regularly and want to avoid the hassle of going to the shop to get rid of the TPMS light when I change them.

Since Subaru uses a pretty basic system that only shows if there is an issue and not independent pressure I'm OK losing the TPMS function permanently as I have the capability and knowledge to regularly check my tire pressures.

Checking with some basic info available online I've learned that Subaru uses 315 mhz unencrypted signals for their TPMS system.

I have now ordered an arduino kit along with some 315 mhz transceivers and will be working on learning some basic python for this project. I know very little coding beyond some basic HTML so this could be fun. I know these units can be programmed to mimic 315 mhz signals very easily so I'm hoping that something a little more complex is within their scale of possibilities.

https://amzn.to/2Im7XyI the arduino kit I ordered

I have also ordered a software defined radio based on the research from Jared Boone (who I have now contacted but not heard back from yet) with a lecture on his research into reading and decoding TPMS signals in Ford vehicles available here:


The end goal is to create a black box that I can run off either batteries or the cars 12V system that will send out the same signal the TPMS Computer/ECU is looking for and getting rid of both the TPMS Icon and the alert notification in the center screen.

Similar to devices like this but not offered for Subaru

This is beyond my typical scope of knowledge but I'm willing and able to put some time into this one right now. If anyone has any helpful advice please post here. An example of helpful advice would be "This won't work because each sensor transmits a unique ID that the arduino or similar system isn't capable of doing" I'll likely delete unhelpful advice such as "live with the light" "put tape on it" "this is too much work" "I'm not contributing anything towards this goal" etc as that was 2/3rds of the other thread and I just don't want the white noise in this thread.

I might also move this to electrical as it's not necessarily Gen 5 specific and also is a possible issue for those with Gen 3 and 4 cars.

Will keep this thread updated with any changes.

atc98092 05-16-2018 12:04 PM

Did Subaru change with the 18s? I have individual tire pressure readouts in my dash.

eagleeye 05-16-2018 12:06 PM

if anyone finds the data that needs to be emulated for Gen3 and Gen4 please post it if it is different.

Brucey 05-16-2018 12:16 PM

Quote:

Originally Posted by atc98092 (Post 5596529)
Did Subaru change with the 18s? I have individual tire pressure readouts in my dash.

Must have. The 17 does not show anything except correct incorrect and error. They transmit PSI based on using the 1500$ scan tool at the shop but there is no way of reading it from the car.

SnowGo 05-16-2018 12:51 PM

11 Attachment(s)
For '17, you could simply use an Ateq Quickset to reprogram the car every time you swap wheels. It's quick and easy. You just need to know the TPMS IDs to do that.

Fibber2 05-16-2018 01:24 PM

I'm by no means an expert in TPMS, but I have worked on several automotive projects with development teams before. TPMS is a 'hobby' for me, so I've bought two home tools, attended a few webinars, done the reading, etc., enough to have been of help to the community on this and several other boards.

1) Yes, the 2018 uses a different system. It's still built by Schrader, but in 2016 they filed with the FCC a request to provide Subaru with a 433 mhz system. That system supports a full dash display with individual readouts. Interestingly enough, they may have also gone to a distributed antenna system as some folks have reported that when rotating tires the system recognizes and adjusts so that the right sensor ID is assigned to the correct corner of the car.

2) I didn't bother checking your attached tread, but 'pipe bombs' won't work with most sensors as they enter sleep mode when the two axis MEMS accelerometer fails to see actual rotation. Bouncing around often isn't enough to get them to transmit reliably.

3) Your Arduino radio approach sounds interesting. An alternative (although I have no idea about the cost), is to just go to the chipset provider and buy a 'developers kit'.

At the core of each sensor is a set of transducers (pressure, temperature, battery voltage, motion, etc.), control circuitry and low power radios. They wake up and transmit upon motion, or when pinged by the low frequency radio. Then on the high freq radio they initially put out a repetitive string to be sure the central receiver hears it, then only periodically (maybe every 10 minutes), and go back to yelling mode if the low pressure or high temp setpoint is reached. Transmission includes something Subaru-specific, the ID of the sensor, then the sensor measured data (pressure/temperature/voltage).

There are a few chip-set makers, and a lot of TPMS wheel sensors (body with tire valve, battery, molded case) and vehicle systems (stand-alone or integrated) makers. Call them integrators. They take a Freescale chip-set and make it into a whole system.

The developers kit allows the mfgr (say Schrader and Subaru together) to work up the program of what features to invoke. That includes what data, what format, how often, how many repeats, signal strength, sleep mode, etc., to balance power/life/function.

Any time a new multifunction chip or module is introduced, a developers kit follows to aid it's adoption in the industry. In concept, you could program up a developers kit (size of a laptop) to emulate a whole Subaru system - transmitters and receivers) and carry it in the car to talk to the vehicle receiver.

4) So now that I've offered some meat, a little time on the soapbox!

a) TPMS is more than just to remind you to top off your tires. It's an important safety system. We've had two incidents (2011 & 2017) where that fast warning of a tire losing pressure saved (at minimum) tire loss, tire & wheel damage, an accident, maybe worse.... I'm a believer. I don't encourage disabling the system.

b) My now 7 year old ATEQ Quickset allows me to swap in the new codes when I rotate in a new set of 4 in about 5 minutes. 3 vehicles in the household, 24 mounted tires (summer and winter).

c) My new little $115 Autel should allow me to clone sensors, and that's my plan going forward when the old hard-coded sensors start to die. You can buy their cloneable sensors for $28 each. Rotate in your new set of 4, and your car won't miss a beat. And they can be rewritten even when mounted in a tire, so you can re-purpose them at will. IMHO, that's really the way to go!

huggy_d1 05-16-2018 01:36 PM

Quote:

Originally Posted by SnowGo (Post 5596577)
For '17, you could simply use an Ateq Quickset to reprogram the car every time you swap wheels. It's quick and easy. You just need to know the TPMS IDs to do that.

$120 on tirerack.com in case you are wondering
Not nearly as fun as hacking the signals.

ammcinnis 05-16-2018 01:48 PM

Quote:

Originally Posted by Brucey (Post 5596449)

Great geeky fun! I miss participating in presentations like that.

Quote:

Originally Posted by Fibber2 (Post 5596601)
An alternative (although I have no idea about the cost), is to just go to the chipset provider and buy a 'developers kit'.

Excellent idea. Even cheaper, though, is to start with the chipset provider's technical data sheet(s) and any available application notes. Read them until you understand them, and then you'll be ready for the developers kit ... or by then you may not even need it.

3.6r Limited 05-16-2018 01:49 PM

Quote:

Originally Posted by SnowGo (Post 5596577)
For '17, you could simply use an Ateq Quickset to reprogram the car every time you swap wheels. It's quick and easy. You just need to know the TPMS IDs to do that.

Yes, the 18's have a new feature for that in the center drivers display.
The previous Gen 5's do not.

Fibber2 05-16-2018 02:47 PM

Yes, Technical Data Sheets, Apps Notes, White Papers, Webinars, IEEE, SAE and other publications or conference proceedings. I even strobe recent patent filings when I truly want to get a boatload of 'down and dirty' details.


All times are GMT -4. The time now is 05:32 AM.

Powered by vBulletin®
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.

vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2019 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2019 DragonByte Technologies Ltd.
Copyright 2009-2010 SubaruOutback.org. All Rights Reserved.

 
For the best viewing experience please update your browser to Google Chrome