[Brucey]

Spawning off this thread:

http://www.subaruoutback.org/forums/138-gen-5-2015-present/409226-has-anyone-built-pipe-bomb-yet-tpms.html

I decided to go ahead and create a new thread since the 'pipe bomb' is now proven not to be a viable solution.

For a quick recap: I have 12 tires (3 sets of 4) that I change regularly and want to avoid the hassle of going to the shop to get rid of the TPMS light when I change them.

Since Subaru uses a pretty basic system that only shows if there is an issue and not independent pressure I'm OK losing the TPMS function permanently as I have the capability and knowledge to regularly check my tire pressures.

Checking with some basic info available online I've learned that Subaru uses 315 mhz unencrypted signals for their TPMS system.

I have now ordered an arduino kit along with some 315 mhz transceivers and will be working on learning some basic python for this project. I know very little coding beyond some basic HTML so this could be fun. I know these units can be programmed to mimic 315 mhz signals very easily so I'm hoping that something a little more complex is within their scale of possibilities.

https://amzn.to/2Im7XyI the arduino kit I ordered

I have also ordered a software defined radio based on the research from Jared Boone (who I have now contacted but not heard back from yet) with a lecture on his research into reading and decoding TPMS signals in Ford vehicles available here:

The end goal is to create a black box that I can run off either batteries or the cars 12V system that will send out the same signal the TPMS Computer/ECU is looking for and getting rid of both the TPMS Icon and the alert notification in the center screen.

Similar to devices like this but not offered for Subaru

This is beyond my typical scope of knowledge but I'm willing and able to put some time into this one right now. If anyone has any helpful advice please post here. An example of helpful advice would be "This won't work because each sensor transmits a unique ID that the arduino or similar system isn't capable of doing" I'll likely delete unhelpful advice such as "live with the light" "put tape on it" "this is too much work" "I'm not contributing anything towards this goal" etc as that was 2/3rds of the other thread and I just don't want the white noise in this thread.

I might also move this to electrical as it's not necessarily Gen 5 specific and also is a possible issue for those with Gen 3 and 4 cars.

Will keep this thread updated with any changes.

 

[atc98092]

Did Subaru change with the 18s? I have individual tire pressure readouts in my dash.

 

[eagleeye]

if anyone finds the data that needs to be emulated for Gen3 and Gen4 please post it if it is different.

 

[Brucey]

Did Subaru change with the 18s? I have individual tire pressure readouts in my dash.

Must have. The 17 does not show anything except correct incorrect and error. They transmit PSI based on using the 1500$ scan tool at the shop but there is no way of reading it from the car.

 

[SnowGo]

For '17, you could simply use an Ateq Quickset to reprogram the car every time you swap wheels. It's quick and easy. You just need to know the TPMS IDs to do that.

 

[Fibber2]

I'm by no means an expert in TPMS, but I have worked on several automotive projects with development teams before. TPMS is a 'hobby' for me, so I've bought two home tools, attended a few webinars, done the reading, etc., enough to have been of help to the community on this and several other boards.

1) Yes, the 2018 uses a different system. It's still built by Schrader, but in 2016 they filed with the FCC a request to provide Subaru with a 433 mhz system. That system supports a full dash display with individual readouts. Interestingly enough, they may have also gone to a distributed antenna system as some folks have reported that when rotating tires the system recognizes and adjusts so that the right sensor ID is assigned to the correct corner of the car.

2) I didn't bother checking your attached tread, but 'pipe bombs' won't work with most sensors as they enter sleep mode when the two axis MEMS accelerometer fails to see actual rotation. Bouncing around often isn't enough to get them to transmit reliably.

3) Your Arduino radio approach sounds interesting. An alternative (although I have no idea about the cost), is to just go to the chipset provider and buy a 'developers kit'.

At the core of each sensor is a set of transducers (pressure, temperature, battery voltage, motion, etc.), control circuitry and low power radios. They wake up and transmit upon motion, or when pinged by the low frequency radio. Then on the high freq radio they initially put out a repetitive string to be sure the central receiver hears it, then only periodically (maybe every 10 minutes), and go back to yelling mode if the low pressure or high temp setpoint is reached. Transmission includes something Subaru-specific, the ID of the sensor, then the sensor measured data (pressure/temperature/voltage).

There are a few chip-set makers, and a lot of TPMS wheel sensors (body with tire valve, battery, molded case) and vehicle systems (stand-alone or integrated) makers. Call them integrators. They take a Freescale chip-set and make it into a whole system.

The developers kit allows the mfgr (say Schrader and Subaru together) to work up the program of what features to invoke. That includes what data, what format, how often, how many repeats, signal strength, sleep mode, etc., to balance power/life/function.

Any time a new multifunction chip or module is introduced, a developers kit follows to aid it's adoption in the industry. In concept, you could program up a developers kit (size of a laptop) to emulate a whole Subaru system - transmitters and receivers) and carry it in the car to talk to the vehicle receiver.

4) So now that I've offered some meat, a little time on the soapbox!

a) TPMS is more than just to remind you to top off your tires. It's an important safety system. We've had two incidents (2011 & 2017) where that fast warning of a tire losing pressure saved (at minimum) tire loss, tire & wheel damage, an accident, maybe worse.... I'm a believer. I don't encourage disabling the system.

b) My now 7 year old ATEQ Quickset allows me to swap in the new codes when I rotate in a new set of 4 in about 5 minutes. 3 vehicles in the household, 24 mounted tires (summer and winter).

c) My new little $115 Autel should allow me to clone sensors, and that's my plan going forward when the old hard-coded sensors start to die. You can buy their cloneable sensors for $28 each. Rotate in your new set of 4, and your car won't miss a beat. And they can be rewritten even when mounted in a tire, so you can re-purpose them at will. IMHO, that's really the way to go!

 

[huggy_d1]

For '17, you could simply use an Ateq Quickset to reprogram the car every time you swap wheels. It's quick and easy. You just need to know the TPMS IDs to do that.

$120 on tirerack.com in case you are wondering
Not nearly as fun as hacking the signals.

 

[ammcinnis]

https://youtu.be/bKqiq2Y43Wg

Great geeky fun! I miss participating in presentations like that.

An alternative (although I have no idea about the cost), is to just go to the chipset provider and buy a 'developers kit'.

Excellent idea. Even cheaper, though, is to start with the chipset provider's technical data sheet(s) and any available application notes. Read them until you understand them, and then you'll be ready for the developers kit ... or by then you may not even need it.

 

[3.6r Limited]

For '17, you could simply use an Ateq Quickset to reprogram the car every time you swap wheels. It's quick and easy. You just need to know the TPMS IDs to do that.

Yes, the 18's have a new feature for that in the center drivers display.
The previous Gen 5's do not.

 

[Fibber2]

Yes, Technical Data Sheets, Apps Notes, White Papers, Webinars, IEEE, SAE and other publications or conference proceedings. I even strobe recent patent filings when I truly want to get a boatload of 'down and dirty' details.

 

[huggy_d1]

Yes, Technical Data Sheets, Apps Notes, White Papers, Webinars, IEEE, SAE and other publications or conference proceedings. I even strobe recent patent filings when I truly want to get a boatload of 'down and dirty' details.

Don't forget github and hackaday (and the like)

 

[Brucey]

3) Your Arduino radio approach sounds interesting. An alternative (although I have no idea about the cost), is to just go to the chipset provider and buy a 'developers kit'.

...words

If I was to mass market this (still theoretical) device a dev kit then going narrowing parts down to the minimum at their most basic functions would be the best bet.

As it stands I've seen Arduino clone 315/433 mhz signals easily so I figured it was a good place to start. Knowing the signal frequency, the fact that it is unencrypted, and already decoded on other manufactures means I'm already close to my goal and piggy backing off others work. It's just reverse engineering it enough to adapt it to our cars instead of Mustangs and Cadillacs.

Cloning sensors is probably the best bet for the "throw money at it" types. It's simple, quick, and easy.

I half want to do this to help out those in the future that can't afford something like that, half want to do it because I hate the way Subaru implemented TPMS in 08-17 vehicles, and half want to do it because everyone keeps telling me I can't. :wink2:

I've simply tuned out "can't" at this point in my life.

Like when I was told I cant make a Gen 2 into a hybrid...

When I was told the CVT Temp cant be read through the OBD2 port...

When I was told I couldn't average 28 MPG in an Outback

When I was told I cant mount an external transmission cooler. When I was told I cant lift the car. When I was told I cant mount whatever tires. When I was told I cant make it across this trail.

Etc

Are all these good ideas? Not necessarily. Have I failed at plenty of other things? Absolutely. Probably more than I've succeeded.

The fun for me is in the challenge.

:wink2:

In the mean while:

 

[atc98092]

:wink2:

In the mean while:

That looks like fun! Years (and years!) ago I built many Heathkit items. Always enjoyed playing with a soldering iron. probably why I got my ham license all those years ago. Makes me want to prowl around in Amazon and see if I can find some sort of kit to play with.

Good luck Brucey. Never let them tell you it can't be done! :grin2:

 

[Brucey]

I spent most of the evening taking lessons on basic arduino stuff. It's actually kind of fun and has a lot of potential. The HAM radio of the 2010's

It includes temp sensors, relays, joysticks, ultrasonic sensors, motors, 4 digit 7 segment, etc etc

So far I've had it blink my name in morse, display my name in an LCD screen, and had it display 6969 on the 4 digit segment.

I'm comfortable enough with that little kit to work on sending 315 mhz codes but now I have to find them and I'll have to wait for the SDR to come in before I'm able to figure out what I need to send out.

 

[Fibber2]

Earlier this evening I finally got a chance to watch that YouTube presentation in your first post. I was a bit disappointed that the author wasn't more up-to-date in the basic subject matter. He really struggled with the most basic questions. But that's another issue.

I found it interesting that he analyzed the delta between the four signals from the test vehicle and was able to imply what the basic portions of the transmission meant. Which part was the hex ID, which part was the pressure, etc.

If the goal is to create your own output signal, then keep at it.

If the goal is to recreate 4 signals that you already have and keep playing those back when those wheels are off the car then the solution could be far more simple. Trigger each sensor, capture the output, and play it back. You can get a single transmission from a single ping. A basic tool like the Autel can do that. It only captures on the screen the basics like the hex ID and pressure but the open air transmission should be complete including the Subaru protocol.

 

[Brucey]

Earlier this evening I finally got a chance to watch that YouTube presentation in your first post. I was a bit disappointed that the author wasn't more up-to-date in the basic subject matter. He really struggled with the most basic questions. But that's another issue.

I found it interesting that he analyzed the delta between the four signals from the test vehicle and was able to imply what the basic portions of the transmission meant. Which part was the hex ID, which part was the pressure, etc.

If the goal is to create your own output signal, then keep at it.

If the goal is to recreate 4 signals that you already have and keep playing those back when those wheels are off the car then the solution could be far more simple. Trigger each sensor, capture the output, and play it back. You can get a single transmission from a single ping. A basic tool like the Autel can do that. It only captures on the screen the basics like the hex ID and pressure but the open air transmission should be complete including the Subaru protocol.

He is fully decoding it but I don't really need to assuming the only goal is to recreate the signal.

I just need the signal from the TPMS that says "Uh, had a slight malfunction. But, uh, everything's perfectly all right now. We're fine. We're all fine here, now, thank you. How are you?"

Do you know if the Arduino (or whatever) is capable of copying this signal natively? I was waiting on the SDR so I could record the signal before uploading to the transceiver to broadcast.

 

[atc98092]

I have an SDR that I use for an ADS-B monitor in my local airspace. Guess I can't stand not sitting at a radar scope anymore, so I have to have my own at home! But they sure are a cool little toy to play with.

 

[Fibber2]

Don't overcomplicate this. All you need to do is trigger each sensor in a properly inflated tire, record the data, string the four pieces together with five to 10 seconds between data sets, and broadcast it every 5 minutes.

 

[Brucey]

Don't overcomplicate this. All you need to do is trigger each sensor in a properly inflated tire, record the data, string the four pieces together with five to 10 seconds between data sets, and broadcast it every 5 minutes.

That's the plan, Fibbo. I'm going to try to copy a different 315mhz signal tonight after work as I have the transceivers in now.

I found a Library for ASK/FSK library here: http://www.airspayce.com/mikem/arduino/RadioHead/

And plan to use it to see if I can copy something in that frequency range.

Once that's done it's just a matter of riding in the car and getting the signals they put out.

 

[Fibber2]

I can't believe I'm actually helping you as I am diametrically opposed to what you were doing here.

That said, capturing signals in its natural environment poses risks for data integrity. You'd be much better off borrowing a pinger and putting your antenna a foot or two away from the sensors.

Remember that the TPMS system was designed to reject false dash light signaling for 20 minutes due to the fact that many corrupted signals reach the central antenna. A true signal of low pressure will give you an near instantaneous light, while a corrupted or missing signal has a 20-minute allowance.