Replies: 13 comments 9 replies
-
|
You'll need an antenna/sdr that can receive around the frequency of interest. Then I expect rtl_433 is suitable. But I really am not familiar with such SDRs. I am unaware of TPMS wakeup/programming, but my impression is that wakeup is not sophisticated. |
Beta Was this translation helpful? Give feedback.
-
|
Well, I didn't find to much information but it looks like that the structure of message is also quite complicated in some systems and similar to tpms messages. |
Beta Was this translation helpful? Give feedback.
-
I've recently completed a project to capture the PKES signals from a Hyundai Tucson (to prove that my key Fob security timeout is working). TPMS is next on my list :-) The 125KHz signal is not a radio wave - it is a magnetic field. (AIUI, to propagate as a Radio wave, it would need to emanate from a 1/4 wavelength aerial - which is pretty long for 125KHz!). To receive it, you need a simple air coil, in very close proximity. (Ready made version here: https://www.rfsolutions.co.uk/rfid-coil-antenna-125khz-p66 for example). The signal can then be rectified (germanium or schottky diode) and filtered via a simple parallel RC circuit. Feeding the resulting signal into a logic analyser, will allow you to visualise the signal. Tuning the coil (with a parallel capacitor) will boost the input voltage signal significantly, but will alter the timing (because it will take time to build-up to its full value and will decay away slowly. See figure 5 in this document: https://ww1.microchip.com/downloads/en/AppNotes/00232B.pdf. |
Beta Was this translation helpful? Give feedback.
-
|
@kenwawa01: You could use RTL-SDR in direct sampling mode. It allows reception from 0 to 14.4 MHz. Check: this article |
Beta Was this translation helpful? Give feedback.
-
|
I'm wondering if reasonable signal quality is here closer to 14 MHz or 0 MHz... Perhaps I will try with this aliexpress box. Probably it's basing on the same trick as in this article but I hope that slightly improved...? However it will be only part of the game. As it will allow listening 125kHz. But how to transmit the same signal for short distances 10-20cm like in tpms activation tools? |
Beta Was this translation helpful? Give feedback.
-
|
No TX is mentioned in the title of this thread. |
Beta Was this translation helpful? Give feedback.
-
|
Right! Improved! :) |
Beta Was this translation helpful? Give feedback.
-
|
Let's focus first of reading 125kHz transmission. Ok with Gqrx I was able to observe 125kHz transmission. It seems to be much slower/longer that 433 MHz as traces for 433MHz are very small height size and for 125kHz it seems to last few seconds (approx. 20x longer). Currently I'm trying to use rtl_433 to decode it, but despite many attempts Im getting exactly 0. I tried to write my own small decoder and also to use -A function and in both cases I get exactly nothing. Any suggestions what parameters should I set to rtl_433 to get this 125kHz transmission for continental tpms sensors. My examples (sure I've did some experiments with -g values and -direct_samp=1/2 and not sure which -s would be the best, if I set it to lower values I get message about failing to set sample rate ): R=258 it's my own decoder. Is some parameters combinations I also get the message about setting low frequency filter. But when i tried to modify it with -l parameter, rtl_433 doesn't run normally but just display message as below and exists:
It's a bit surprising than when I set frequency to 125kHz, the low pas filter for 250kHz is set, ex. for this:
I get:
How to turn off the low pass filter? Any suggestions would be welcome? |
Beta Was this translation helpful? Give feedback.
-
|
Just to add, I tried to increase scan to 1024k and tried also with -M level -Y autolevel -Y minmax Btw, I'm using Gqrx to observe my signal. Is there any way to record this signal from Gqrx as some kind of audio file to observe how does it change exactly in time? Ex. to try to guess how long last 0 an 1. What ofther Linux based software could be helpful here? |
Beta Was this translation helpful? Give feedback.
-
|
You don't need the filter options ( Try to record the signal ( |
Beta Was this translation helpful? Give feedback.
-
|
I feel a bit lost... I've recorded cu8 files as you suggest, with direct sampling on and off and... for me these files look empty. It could also happen that it did sth wrong when importing them to Audacity as I received two times longer time than expected. However I also recorded two files from Gqrx in order to have comparison - as raw files from this software and here the signals are clearly visible. If I look on this in Qgrx I can see 3 signals, two very strong and 3rd hardly noticeable (probably the 3rd is the sensor response). It might be also the case that the quality of my receiver is too low... For rtl_433 I decided to use two samplings 500k and 1000k as I was afraid that low cut filter which is set automatically might some impact on 1000k results (it's set to 100kHz then). Any comments from your side? And the files: rtl_433 Gqrx And one thing more, when using the same device on 433MHz in rtl_433, I'm getting very clear signal without any problems. |
Beta Was this translation helpful? Give feedback.
-
|
The files are just very quiet, not empty. And there is a signal at 125kHz, observe in https://triq.org/pdv/ (or https://triq.org/spectrogram-next/ for zoom-in and waveform display). |
Beta Was this translation helpful? Give feedback.
-
|
Well, I will have to spend more time on that (and time is missing). I'm wondering about one thing. The signal from rtl_433 is so weak... but the signal from Gqrx is so strong and visible. Why is that like this? Have you looked on Gqrx files? I will try with -f 100k later. I'm also wondering if using any of arduino rfid readers 125kHz connected to arduino or esp32 could be a better idea here? Those "antennas" are for one frequency only and the signal should be of better quality...? Ex. sth like this https://pl.aliexpress.com/item/1005006337836266.html or this https://pl.aliexpress.com/item/1005002688104886.html I searched a lot of web pages and I was not able to find any DIY homebrew project for waking up tpms sensors (not counting those the simplest/oldest type ones where almost any 125kHz without any data can wake them up)... Have you perhaps seen sth as example? |
Beta Was this translation helpful? Give feedback.
-
|
The Gqrx data is demodulated. Is it a FM demod? Then in theory amplitude won't matter. As @hornbyp commented the signal is magnetic, maybe that's not common or interesting in the SDR space. |
Beta Was this translation helpful? Give feedback.
-
|
Well, in Gqrx data might be demodulated or not. I set it to Raw IQ mode. I will have to check how much does it differs from Demodulated off. But you are right, it might be the reason. I might try one of these devices from aliexpress and compare how it works. They are not expensive... Do you have any suggestion what might be the parameters of this 125kHz signal? |
Beta Was this translation helpful? Give feedback.
-
|
Ok, I tried a lot of different option and for me my recordings are worth nothings. In my humble opinion the signal to noise ration is too bad and it's difficult to distinct noise from real signal. There is sth in those recordings but without any value. I have to focus how to improve the quality of signal before I will do sth more... What antenna would be good for 125kHz signal? Good and cheap sure. :P |
Beta Was this translation helpful? Give feedback.
-
|
¼λ ground plane. I use it - works perfectly on 433M. |
Beta Was this translation helpful? Give feedback.
-
|
I expect 433MHz and 125 kHz to be quite different. For the later the magnetic field will be more useful, which suggests a tuned coil. |
Beta Was this translation helpful? Give feedback.
-
|
ohhh... dammit, I forgot!! This is not 433M. Disregard my previous post. Having done radio circuits for fun with my father (some 45 years ago, or so, i.e. when I was a kid) I would expect a ferrite antena from an old radio (with LW band) to work perfectly. |
Beta Was this translation helpful? Give feedback.
-
I refer you to my response of two weeks ago, which you didn't acknowledge. A simple air coil (pre-fabricated or home made) should yield a signal of several VOLTS pk-pk. Stuffing that into your average RTL-SDR capable hardware would probably do it no good at all! (Can it even tune that low?) Tuning the coil with a capacitor (or adding a ferrite rod) will increase the signal level - at the expense of the waveform shape (see that microchip PDF). My experiments with tuning, used a 125KHz signal from a microcontroller and a 'scope. (The 125KHz transmitter is (probably) modulating the signal by turning it ON and OFF. However, its LC tank circuit takes a little while to 'fill up' and a little while to 'empty' when the signal is applied and removed. If you add more of this at the receiving end, it will be difficult to ascertain what the timing actually is). If you only want to capture and reproduce this 125KHz signal, you don't actually need to understand it! The PKES signal that emanates from my car door, looks like this: I can see a Preamble, a Start-bit, Data and a Stop bit. Effectively, the data is represented by four combinations of short or long pulses and short or long gaps, so that's what my software recreates - with no idea of its meaning. (If anyone can spot the encoding, I would be interested to know!) |
Beta Was this translation helpful? Give feedback.
-
|
This is an example of the sort of received signal you should see - in this case using about 30 turns of flexible wire wound into a ~30cm diameter coil.
The blue signal is the data you're trying to recover, (modulating a 125KHz square wave using a mosfet H bridge) |
Beta Was this translation helpful? Give feedback.
-
|
It's not like that I didn't acknowledge. I've already ordered two things which I hope might become antennas, one is rfid antenna, second is ferrite with coil but I have to wait until I get them and then I will see what I will be able to get as result. That's why I didn't focused on this area not having "toys" for experiments. Concerning this image, that's what I'm expecting to get, but currently I'm getting sth which is almost flat and I have problems to distinct noise from real data. And yes I want to understand the protocol, at least up to possible extent, and not only to repeat the signal. |
Beta Was this translation helpful? Give feedback.
-
Hi!
One thing which comes to my mind is to record the transmission between tpms wakeup/programming tool and tpms sensor itsel. AFAIK it's based on low frequency transmission, usually probably 125kHz.
On the Internet I can find many many threads about 433MHz transmission analysis but it seems that noone (or almost noone) is having public discussion about this LF part.
What device would be the best for recording? I was wondering if such a device could help here: https://pl.aliexpress.com/item/1005003747296138.html If not, would you recommend?
Is there any chance to make rtl_433 (perhaps with some minor modifications) to work on 125kHz with this device? If not, what software could you recommend?
Have you ever found any projects publicly available when someone tried to analyse tpms wakeup/activation/programming sequences? All links would be highly welcome. :P
Beta Was this translation helpful? Give feedback.
All reactions