2023 KIA EV6 TPMS not decodable

fresh4 commented 4 days ago

I've been testing TPMS RX via rtl_433 and an RTL SDR and have been able to detect most tested sensors except for one belonging to a 2023 KIA EV6. I was able to capture information with -A, and I did test the disabled by default -R decoders. Specifically, -R 123 returned an incorrectly decoded output. I'm fairly novice to rtl_433, so let me know if there's anything else I need to include or if I did something wrong.

Here is the analyzer output for the captured signal with this command: \ rtl_433 -R 123 -r g005_433.92M_250k.cu8 -C customary -A

> rtl_433 -R 123 -r g005_433.92M_250k.cu8 -C customary -A      
rtl_433 version 23.11 (2023-11-28) inputs file rtl_tcp RTL-SDR SoapySDR
Reading conf from "/etc/rtl_433/rtl_433.conf".
[Input] Test mode active. Reading samples from file: g005_433.92M_250k.cu8
Detected FSK package    @0.164064s
Analyzing pulses...
Total count:   23,  width: 8.82 ms      ( 2204 S)
Pulse width distribution:
 [ 0] count:   20,  width:  172 us [172;180]    (  43 S)
 [ 1] count:    3,  width:  364 us [348;404]    (  91 S)
Gap width distribution:
 [ 0] count:   20,  width:  172 us [172;180]    (  43 S)
 [ 1] count:    2,  width:  352 us [352;352]    (  88 S)
Pulse period distribution:
 [ 0] count:   19,  width:  348 us [348;360]    (  87 S)
 [ 1] count:    2,  width:  524 us [524;528]    ( 131 S)
 [ 2] count:    1,  width:  700 us [700;700]    ( 175 S)
Pulse timing distribution:
 [ 0] count:   40,  width:  172 us [172;180]    (  43 S)
 [ 1] count:    5,  width:  360 us [348;404]    (  90 S)
 [ 2] count:    1,  width:    0 us [0;0]    (   0 S)
Level estimates [high, low]:  15986,     30
RSSI: -0.1 dB SNR: 27.3 dB Noise: -27.4 dB
Frequency offsets [F1, F2]:    7376,  -7950 (+28.1 kHz, -30.3 kHz)
Guessing modulation: Manchester coding
view at https://triq.org/pdv/#AAB10300AC01680000808080808080808080808080808080808080809081919255
Attempting demodulation... short_width: 172, long_width: 0, reset_limit: 356, sync_width: 0
Unsupported

Detected FSK package    @0.269712s
Analyzing pulses...
Total count:   52,  width: 21.42 ms     ( 5355 S)
Pulse width distribution:
 [ 0] count:   42,  width:  172 us [172;180]    (  43 S)
 [ 1] count:   10,  width:  356 us [348;412]    (  89 S)
Gap width distribution:
 [ 0] count:   42,  width:  172 us [172;180]    (  43 S)
 [ 1] count:    9,  width:  348 us [348;352]    (  87 S)
Pulse period distribution:
 [ 0] count:   36,  width:  348 us [348;360]    (  87 S)
 [ 1] count:   12,  width:  524 us [524;528]    ( 131 S)
 [ 2] count:    3,  width:  696 us [696;700]    ( 174 S)
Pulse timing distribution:
 [ 0] count:   84,  width:  172 us [172;180]    (  43 S)
 [ 1] count:   19,  width:  352 us [348;412]    (  88 S)
 [ 2] count:    1,  width:    0 us [0;0]    (   0 S)
Level estimates [high, low]:  15873,     23
RSSI: -0.1 dB SNR: 28.4 dB Noise: -28.5 dB
Frequency offsets [F1, F2]:    9580,  -8096 (+36.5 kHz, -30.9 kHz)
Guessing modulation: Manchester coding
view at https://triq.org/pdv/#AAB10300AC016000008080808080808080808080808080808080808090808190818090819080808180918080908190808191918080808080808080809255
Attempting demodulation... short_width: 172, long_width: 0, reset_limit: 356, sync_width: 0
Unsupported

Detected FSK package    @1.041708s
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @1.041708s
model     : Jansite      type      : TPMS          id        : 867a058
flags     : 9            Pressure  : 17 PSI        Temperature: 172 F        code      : 867a058945805c
Analyzing pulses...
Total count:   71,  width: 9.43 ms      ( 2358 S)
Pulse width distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:   50,  width:   52 us [48;64]  (  13 S)
 [ 2] count:   19,  width:  104 us [104;108]    (  26 S)
 [ 3] count:    1,  width:    4 us [4;4]    (   1 S)
Gap width distribution:
 [ 0] count:   51,  width:   48 us [44;56]  (  12 S)
 [ 1] count:   18,  width:  104 us [104;108]    (  26 S)
 [ 2] count:    1,  width:  312 us [312;312]    (  78 S)
Pulse period distribution:
 [ 0] count:    1,  width:   56 us [56;56]  (  14 S)
 [ 1] count:   42,  width:  104 us [104;108]    (  26 S)
 [ 2] count:   16,  width:  156 us [152;160]    (  39 S)
 [ 3] count:   10,  width:  208 us [208;208]    (  52 S)
 [ 4] count:    1,  width:  416 us [416;416]    ( 104 S)
Pulse timing distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:  101,  width:   52 us [44;64]  (  13 S)
 [ 2] count:   37,  width:  104 us [104;108]    (  26 S)
 [ 3] count:    1,  width:    4 us [4;4]    (   1 S)
 [ 4] count:    1,  width:  312 us [312;312]    (  78 S)
 [ 5] count:    1,  width:    0 us [0;0]    (   0 S)
Level estimates [high, low]:  16008,     27
RSSI: -0.1 dB SNR: 27.7 dB Noise: -27.8 dB
Frequency offsets [F1, F2]:    8819, -11526 (+33.6 kHz, -44.0 kHz)
Guessing modulation: Pulse Width Modulation with sync/delimiter
view at https://triq.org/pdv/#AAB0540601000000340068000401380000819191919191919191919191919191A192919191A19291A1919192A29191919191A2A1929191A291A2A29191A2A19291919191919191A2A19192919191A291A192A192A2A2A455+AAB00F0601000000340068000401380000B055
Attempting demodulation... short_width: 52, long_width: 104, reset_limit: 316, sync_width: 4
Use a flex decoder with -X 'n=name,m=FSK_PWM,s=52,l=104,r=316,g=0,t=0,y=4'
[pulse_slicer_pwm] Analyzer Device
codes     : {69}fffdeddf3a67f9f540, {0}0

Detected FSK package    @1.202636s
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @1.202636s
model     : Jansite      type      : TPMS          id        : 867a058
flags     : 9            Pressure  : 17 PSI        Temperature: 172 F        code      : 867a058945805c
Analyzing pulses...
Total count:   71,  width: 9.43 ms      ( 2358 S)
Pulse width distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:   51,  width:   52 us [48;60]  (  13 S)
 [ 2] count:   19,  width:  100 us [100;104]    (  25 S)
Gap width distribution:
 [ 0] count:   51,  width:   48 us [48;56]  (  12 S)
 [ 1] count:   18,  width:  104 us [100;108]    (  26 S)
 [ 2] count:    1,  width:  268 us [268;268]    (  67 S)
Pulse period distribution:
 [ 0] count:    1,  width:   56 us [56;56]  (  14 S)
 [ 1] count:   42,  width:  104 us [100;108]    (  26 S)
 [ 2] count:   16,  width:  152 us [152;156]    (  38 S)
 [ 3] count:   10,  width:  208 us [204;212]    (  52 S)
 [ 4] count:    1,  width:  372 us [372;372]    (  93 S)
Pulse timing distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:  102,  width:   52 us [48;60]  (  13 S)
 [ 2] count:   37,  width:  100 us [100;108]    (  25 S)
 [ 3] count:    1,  width:  268 us [268;268]    (  67 S)
 [ 4] count:    1,  width:    0 us [0;0]    (   0 S)
Level estimates [high, low]:  15877,     10
RSSI: -0.1 dB SNR: 32.0 dB Noise: -32.1 dB
Frequency offsets [F1, F2]:    9227, -12320 (+35.2 kHz, -47.0 kHz)
Guessing modulation: Pulse Width Modulation with multiple packets
view at https://triq.org/pdv/#AAB0520501000000340064010C0000819191919191919191919191919191A192919191A19291A1919192A29191919191A2A1929191A291A2A29191A2A19291919191919191A2A19192919191A291A192A192A2A2A355+AAB00D0501000000340064010C00009055
Attempting demodulation... short_width: 52, long_width: 100, reset_limit: 272, sync_width: 0
Use a flex decoder with -X 'n=name,m=FSK_PWM,s=52,l=100,r=272,g=112,t=19,y=0'
[pulse_slicer_pwm] Analyzer Device
codes     : {69}fffdeddf3a67f9f540, {1}8

Detected FSK package    @1.356912s
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @1.356912s
model     : Jansite      type      : TPMS          id        : 867a058
flags     : 9            Pressure  : 17 PSI        Temperature: 172 F        code      : 867a058945805c
Analyzing pulses...
Total count:   70,  width: 9.11 ms      ( 2278 S)
Pulse width distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:   50,  width:   52 us [52;64]  (  13 S)
 [ 2] count:   19,  width:  104 us [104;104]    (  26 S)
Gap width distribution:
 [ 0] count:   51,  width:   48 us [44;56]  (  12 S)
 [ 1] count:   18,  width:  104 us [104;104]    (  26 S)
Pulse period distribution:
 [ 0] count:    1,  width:   56 us [56;56]  (  14 S)
 [ 1] count:   42,  width:  104 us [104;108]    (  26 S)
 [ 2] count:   16,  width:  156 us [156;156]    (  39 S)
 [ 3] count:   10,  width:  208 us [208;208]    (  52 S)
Pulse timing distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:  101,  width:   52 us [44;64]  (  13 S)
 [ 2] count:   37,  width:  104 us [104;104]    (  26 S)
 [ 3] count:    1,  width:  320 us [320;320]    (  80 S)
Level estimates [high, low]:  15974,     59
RSSI: -0.1 dB SNR: 24.3 dB Noise: -24.4 dB
Frequency offsets [F1, F2]:    8965, -10540 (+34.2 kHz, -40.2 kHz)
Guessing modulation: No clue...
view at https://triq.org/pdv/#AAB1040000003400680140819191919191919191919191919191A192919191A19291A1919192A29191919191A2A1929191A291A2A29191A2A19291919191919191A2A19192919191A291A192A192A2A2A355

Detected FSK package    @1.497896s
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : @1.497896s
model     : Jansite      type      : TPMS          id        : 867a058
flags     : 9            Pressure  : 17 PSI        Temperature: 172 F        code      : 867a058945805c
Analyzing pulses...
Total count:   71,  width: 9.43 ms      ( 2358 S)
Pulse width distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:   50,  width:   52 us [52;64]  (  13 S)
 [ 2] count:   19,  width:  104 us [104;104]    (  26 S)
 [ 3] count:    1,  width:   32 us [32;32]  (   8 S)
Gap width distribution:
 [ 0] count:   51,  width:   48 us [44;56]  (  12 S)
 [ 1] count:   18,  width:  104 us [104;104]    (  26 S)
 [ 2] count:    1,  width:  288 us [288;288]    (  72 S)
Pulse period distribution:
 [ 0] count:    1,  width:   56 us [56;56]  (  14 S)
 [ 1] count:   42,  width:  104 us [104;108]    (  26 S)
 [ 2] count:   16,  width:  156 us [156;156]    (  39 S)
 [ 3] count:   10,  width:  208 us [208;208]    (  52 S)
 [ 4] count:    1,  width:  392 us [392;392]    (  98 S)
Pulse timing distribution:
 [ 0] count:    1,  width:    0 us [0;0]    (   0 S)
 [ 1] count:  101,  width:   52 us [44;64]  (  13 S)
 [ 2] count:   37,  width:  104 us [104;104]    (  26 S)
 [ 3] count:    1,  width:   32 us [32;32]  (   8 S)
 [ 4] count:    1,  width:  288 us [288;288]    (  72 S)
 [ 5] count:    1,  width:    0 us [0;0]    (   0 S)
Level estimates [high, low]:  15924,     36
RSSI: -0.1 dB SNR: 26.5 dB Noise: -26.6 dB
Frequency offsets [F1, F2]:    9597, -11162 (+36.6 kHz, -42.6 kHz)
Guessing modulation: Pulse Width Modulation with sync/delimiter
view at https://triq.org/pdv/#AAB0540601000000340068002001200000819191919191919191919191919191A192919191A19291A1919192A29191919191A2A1929191A291A2A29191A2A19291919191919191A2A19192919191A291A192A192A2A2A455+AAB00F0601000000340068002001200000B055
Attempting demodulation... short_width: 52, long_width: 104, reset_limit: 292, sync_width: 32
Use a flex decoder with -X 'n=name,m=FSK_PWM,s=52,l=104,r=292,g=0,t=0,y=32'
[pulse_slicer_pwm] Analyzer Device
codes     : {69}fffdeddf3a67f9f540, {0}0

THE ACTUAL DATA for this signal based on the TPMS sensor I used (as opposed to what the 123 decoder gives) is\ ID: 8679EDB4\ PSI: 34.5\ Temperature: 91F

Hopefully that helps with decoding; I'm not so sure how to do so myself.

zuckschwerdt commented 3 days ago

The later signals look like TPMS, 50µs PCM (MC) is common. I.e. this will work to get raw data: -X 'n=name,m=FSK_PCM,s=52,l=52,r=150,bits>=60'

Your examples have raw data of 5555555695696A99556695966566955566A55969A666 which MC decoded is fffe 7985 fa76 ba7f a3d9 2a or the inverse 0001 867a 0589 4580 5c26 d5 (which starts with the ID you have). Try to find more raw codes and create a BitBench like this.

fresh4 commented 2 days ago

@zuckschwerdt you'll have to forgive me as signal processing is not my wheelhouse. I will try to collect more samples and see what I can do. How do you come up with the flex decoder that you're using? I've read the documentation but of course being pretty unfamiliar I'm not sure what each thing (l,s,y, etc) means exactly.

As an aside, I'm pretty sure (most?) TPMS signals use a 32 bit ID (after the preamble, I guess). There's a chance that the ID I provided was actually for a different tire on the same car, so 867a0589 might be the real ID. I will check when I'm able to get more samples.

zuckschwerdt commented 2 days ago

It's just the minimum of options to get a working flex decoder: modulation (m) FSK with PCM slicer, short and long symbol (s, l) are the same "half-bit" length of 52 µs, and since we must never see any gap or pulse of more that two identical bits in Manchester coding the reset (r) of slightly longer that 2x 52 (and then demanding some minimum number of bits).

merbanan / rtl_433

2023 KIA EV6 TPMS not decodable #3097