Analyzing BMW Continental TPMS

[kelogs]

recorded cu8 signals in https://github.com/merbanan/rtl_433_tests/tree/master/tests/continental_tpms/01

i can't make anything useful out of those recording. Tried with

$ rtl_433 -R 0 -X "n=MYFIRSTTEST,m=FSK_PCM,s=26.042,l=26.042,r=1000" -r ~/bmw_g004_433.92M_250k.cu8

$ rtl_433 -s 250k -W /home/kellogs/bmw_g004_433.92M_250k.sr /home/kellogs/bmw_g004_433.92M_250k.cu8

Looked for the IDs provided but the signal appears unrecognizable to me. How do i extract the useful data (including known ID) from them ?

Thank you

[zuckschwerdt]

Aren't the Continental TPMS 50 µs? I.e. -X 'n=name,m=FSK_PCM,s=52,l=52,r=900'

[kelogs]

Hmm, it seems to be half working: $ rtl_433 -R 0 -X "n=MYFIRSTTEST,m=FSK_PCM,s=52,l=52,r=900" -r ~/bmw_g001_433.92M_250k.cu8 rtl_433 version nightly-3-g70d84d01 branch master at 202308211241 inputs ... codes : {108}0002803b86c945024b48019173f ... codes : {108}fff2803b86c945024b48019202e ... codes : {107}000500770d928a04969003265be

[zuckschwerdt]

That's the codes we expect, very good. Now put them in a BitBench like this and play with invert and shift to see if you can find the ID.

[zuckschwerdt]

Ah, it actually works in this alignment. The codes are

80 3b86c945 024b 480191 73
80 3b86c945 024b 480192 02
80 3b86c945 024b 480193 2d
80 3b86c945 024a 480191 c6
80 3b86c945 024a 480192 b7
80 3b86c945 024a 480193 98
80 3b8273b0 014a 480192 3f
80 3b8273b0 014a 480193 10

And the last byte is a CRC-8 poly 0x2f init 0xaa.

[kelogs]

The IDs are present in just two of the three rows: 3b86c945 Also, should there have not been 4 rows instead of 3 ?

[zuckschwerdt]

Try a flex decoder with alignment (preamble)
rtl_433 -R 0 -X "n=BMW,m=FSK_PCM,s=52,l=52,r=900,preamble=2,bits>=106,bits<=108"

Now try to inflate or deflate very slowly and capture the codes. Look for the digits that change: those are the pressure.
Or slowly change the temperature and spot that field in the codes.

[kelogs]

(v) Good game!

[Miguel077]

Any Results?
Would be great, if BMW TPMS could be added to the device list.

[ProfBoc75]

Hi All,

We just merged a PR #2834 to add the support of BMW Gen5 TPMS multi-brand, and sounds like your Continental samples are working with a little gap is pressure and temperature values due to conversion. With this last version of rtl_433 add -Y minmax to get results with the 4 samples.

It's strange that it works because my decode part is FSK_PCM, then MC + Invert, but could be explained by the half of pulse duration.

From the other issue #2821 the Temp_C = Temp_Raw - 52 , from my side (I collected lot of samples from the street) , it's more Temp_C = Temp_Raw - 50 (like most of other TPMS sensors) , and sounds to be confirmed here with your information. This could remove the Temp gap of 2°C.

Feel free to open an issue in rtl_433 and report your findings.

[kenwawa01]

I tried to contribute with adding my own tpms sensors to rtl_433 project but as first steps I decided to analyze your work as example.

However I stopped in the first steps. After successful compilation, I downloaded locally your cu8 files, but when typing

rtl_433 -R 0 -X "n=MYFIRSTTEST,m=FSK_PCM,s=26.042,l=26.042,r=1000" -r mylocalfile

I get (that's all, nothing more, -A add some additional output)

rtl_433 version 23.11 (2023-11-28) inputs file rtl_tcp RTL-SDR with TLS Disabling all device decoders. [Input] Test mode active. Reading samples from file: g001_433.92M_250k.cu8

And when trying with

rtl_433 -R 0 -X "n=BMW,m=FSK_PCM,s=52,l=52,r=900,preamble=2,bits>=106,bits<=108" -r mylocal file

I get exactly the same. While I would expect first bytes decodes as in your case.

P.S. While adding -vvv I get

rtl_433 version 23.11 (2023-11-28) inputs file rtl_tcp RTL-SDR with TLS Disabling all device decoders. [Protocols] Registered 1 out of 257 device decoding protocols [Input] Test mode active. Reading samples from file: g001_433.92M_250k.cu8 [Input] Input format "CU8 IQ (2ch uint8)" [Baseband] low pass filter for 250000 Hz at cutoff 25000 Hz, 40.0 us [Input] Test mode file issued 2 packets

What am I doing wrong? Or could you provide your full rtl_433 command please?