Hacker News Reader

Comment by landr0id | Hacker News Reader

TIL TPMS works over RF. The blog mentions that it's at a super low power, and not that I'd ever want this, but I can't help but wonder if it's possible to set up well-placed sensors at a fixed position on a road to capture IDs going by -- effectively tracking vehicles themselves.

View on HN

Yes, it’s possible. https://m.youtube.com/watch?v=TDYoo7TGNcw&t=7m45s

To elaborate on the range of these things that others have mentioned, I too am seeing people's sensors from fairly far away.

I've got an RTL-SDR running rtl_433 on an RPi sitting in my living room, and I regularly see TPMS sensors from at least 6 different vehicles. The sensors identify as Renault, Schrader, Abarth 124 Spider, Schrader-EG53MA4, Citroen, and Ford.

For the Schrader ones I see enough different IDs that I think I'm seeing more than one car, so I'm probably seeing a few more than 6 different vehicles.

The antenna, which is just the little few inch thing long that came with the RTL-SDR, is about 85 feet from the street in front of my house, 60 feet from a dead end gravel road that runs by the side of my house, 113 feet and 116 feet from where my nearest two neighbors park, and 165 feet from where each of the next two nearest neighbors park.

The Citreon pressure is around 125 kPa, which is about half of what nearly everything else, so I'm curious what kind of vehicle that one is.

I'm the author of this post. I don't know why I had so much trouble picking up my own sensors. I agree, I've seen a lot of people say they can pick them up from pretty far away too. I'm still not sure about my antenna situation, but I just picked up a couple of Citroen sensors from a car driving by (~75 ft away) and they reported 130 and 131 kPa. I also saw one that was reporting 123 kPa during one of my drives while troubleshooting. Although my own "Citroen" sensors are definitely reporting the correct pressures, I'm thinking maybe there's another model that reports half of the actual pressure or something.

I'm also curious why they report a manufacturer of "Citroen". Isn't that a French automobile manufacturer? I wonder if someone originally observed this protocol on a Citroen car, but it's really just one of the main protocols used by the big TPMS sensor manufacturers like Schrader. I really doubt the sensors on my Dodge Ram are made by Citroen...

Both Dodge and Citröen are owned by Stellantis, so they're probably sharing some code or a supplier between the two brands.

FCA (Dodge) and PSA (Citroen) merger was started in 2019 so it's after the vehicle (2009) was sold.

I'm not too sure about the accuracy of the sensor IDs. I've supposedly seen several abarth spiders pass by my house but I've never actually seen one in person around me, they're not common near me.

I looked into this a couple years ago and a company had a patent for using TPMS tracking for traffic counts (instead of putting down those pneumatic tubes).

However, I seem to remember that new cars have been implementing something different so less and less cars will have this.

Yes, some cars use the abs sensors to detect rotation differences and estimate a low tire pressure scenario.

I was told by two different tire places that my wife's car (2015 CX-5) uses the ABS sensors to detect if one wheel is spinning differently than the others. A flat tire rotates faster than one full of air because it's smaller.

I had the warning light come on twice recently: once, I pulled over to the shoulder when an ambulance was approaching. As I accelerated to get back on the highway, the warning light came on. I thought I'd run over a piece of glass or something. Using the gauge showed nothing wrong. Reset the TPMS.

Later, we were starting on a 30-mile drive down a gravel road in Eastern Oregon. The TPMS light came on. I took a deep breath, kept driving and after we reached our destination, I reset the TPMS and it hasn't come on since.

My conclusion is that I accelerated too quickly on the shoulder and some gravel or debris made a wheel spin faster. The second time, there was presumably more gravel on one side of the car and again one of the wheels spun faster.

My wife's car is 2WD. I wonder if either would have happened in an AWD.

Nah, it's probably not slight wheelspin because that would be a normal case that's handled by traction control. It wouldn't make sense for the system to both control wheelspin with traction control AND report it as a low tire pressure condition. Presumably the TPMS alert would be triggered by a longer term rotational difference. It happens for all kinds of reasons (eg, going into colder temps).

You likely have an ABS sensor issue - the wheel-speed sensor systems don't get triggered that quickly.

I have a CX-5 2016, and done things like overheated the transmission in loose sand. Never had the TPMS come on from wheel slippage.

My car uses ABS for it and the light goes out after something like 10 seconds of non detection above 30 mph.

Newer Teslas are using Bluetooth Low Energy. I suspect that some other manufacturers might do something similar.

Yeah, you absolutely can - speaking from experience.

Of course. Bruce Schneier figured this out in 2008:

https://www.schneier.com/blog/archives/2008/04/tracking_vehi...

I can capture the TPMS data from my neighbor's vehicles from inside my house, with a barely-optimized antenna. It's not that low power.

Similarly, I am almost certain my car catches the sensors in the summer tires in the garage while I have my winter tires installed.

My winter tires don't have sensors, and it takes many KMs of driving before I get the sensor failure chime.

The same process repeats every morning.

The sensors should stay off at rest though (There's acceleration sensors in the that activate them above a certain rpm value)

Many sensors will transmit once an hour (or some other long interval) to let the mothership know they're still alive. Or to warn you of a flat before you've left your house.

This is definitely true for me. I take my car to the track, and my spare wheel/tire combos are stacked right next to where I park the car. When I take short trips around my town with my track wheels on, the TPMS light never illuminates. But about 30 minutes into my drive to the track, it comes on. It turns off again after I park in the garage again.

Don't license plates work just as well for tracking? And if it's the person and not the vehicle, phone tracking is more accurate.

There are definitely many better ways of doing this, it’s more of a thought experiment.

RF tracking would be better if you don't have access to a location with line-of-sight to the passing traffic. Also cheaper than OCR-ing camera footage, and can track vehicles going in both directions, trucks towing trailers, cars with no front plate, etc.

Plate tracking is better for determining direction, and is probably more reliable because TPMS aren't constantly transmitting. You could miss a car if it doesn't have any TPMS info transmitting while it passes your station.

Is phone tracking still possible for the latest iOS or Android phones? I thought my BLE and MAC addresses are randomized, but I don't know much about this beyond that headline. I'm guessing a Stingray type device would still work though.

> Plate tracking is better for determining direction, and is probably more reliable because TPMS aren't constantly transmitting.

And also because direct-sensed TPMS is only one way of implementing TPMS. Other implementations use wheel-speed sensors which are hard wired, not RF.

There are implementations that use the ABS sensors. They don't report the pressure.

Yes, this is trivial and you can do it in about 5 minutes after unboxing your first RTLSDR dongle. Just install rtl_433 and read the commandline help.

Next step is to make a database that recognizes sensors that come past at the same time each day, or correlates groups of four sensors that seem to travel together which probably means they represent the four wheels of the same car, and that's where my software-fu falls flat.

Reply on news.ycombinator.com