Robby BMW

This threads explains how I've made my custom USB tyre pressure monitoring system by hacking this aftermarket kit bought on eBay.

The first step was to detect the RF transmission encoding method used by the sensors.
To do this it would have been required a very expensive logic analyzer, but fortunately I found this nice program that allows to simulate it (albeit with many restrictions) through the LPT port.

So the first thing was to open the display/receiver unit provided with the kit and, after having identified the receiver, start analyzing the data sent by the sensors.




After many samples, I deduced that the encoding method used from the system is a sort of PWM format (Differential Manchester) with dT (basic pulse element) time of about 50 μs and a bit period of 2xdT (about 100 μs).
Discovered this, I’ve noticed that the whole data packet consist of 12 bytes (96 bits) organized in this way:

Preamble (16 bits) - The preamble is a series of 15 logic ‘1’ bits followed by a single logic ‘0’ bit (FFFE in hexadecimal), used to recognize the RF transmission as a valid TX message.

Transmitter ID (32 bits): The 32 transmitter ID bits are used to uniquely identify each sensor.

Pressure (8 bit): The tire pressure in kPa is obtained by multiplying the unsigned binary value of this byte by 2.5 and subtracting 100 (the atmospheric pressure) from the result.

Temperature (8 bits): The temperature in °C is obtained by subtracting 40 from this unsigned binary value.

Battery (8 bits): The 7 least significant bits indicates the battery condition as percentage (100 indicate the 100% of charge).

Sensor state (8 bits): The bits 0 and 1 of this byte contains the following information:
00 = Storage mode (Pressure is measured every 60 seconds but no data is sent)
01 = Normal mode (Pressure is measured every 3.4 seconds and data is transmitted every 60 seconds)
10 = Pressure alert mode (Pressure is measured every 0.85 seconds and data is sent every 0.85 seconds. This sequence is repeated 256 times)
11 = Temperature alert mode (If the temperature exceeds 120°C, the sensor device enters into the same measurement and transmitting pattern as the pressure alert mode)

CRC (16 bits): Implement according to CCITT (0xFFFF) standards.

__________________
_______________________________________
Car installation 95% [■■■■■■■■■■■■■■■■■■■■]
Current project: Parking sensor USB interface