DIY TPMS Programmer

[VirginiaJim]

http://youtu.be/__urA6qNxLw

[RedRambler]

<So there IS a way to retrieve the code numbers from a TPS without taking the tire off?>

There are two options.  Neither involves removing the tire.

1. If the sensor ID has been previously programmed into the ECU, you can issue commands to the ECU to return the sensor ID number.

or

2. If the sensor ID is not known and has not been programmed to the ECU, you can connect a device like I have made to log all the 0x695 messages that are broadcast.  All messages from unknown sensors are broadcast with ID 0x695, DLC = 8, Data0 - Data4 = sensor ID, with the pressure reading in Data5.  Data7 = 0xff for unknown sensors.  You would need to connect the data logger and then ride the bike around the block to give the tire sensors time to transmit.  They transmit about every minute or so when the bike is moving.  The sensor messages can then be reviewed.  The sensor ID will be readily apparent in the first four data bytes of the 0x695 messages.

Not only was I picking up the transmissions from my own rear sensor, I fairly regularly picked up messages from tire sensors which were apparently on other vehicles as I rode around the city in traffic.  This is really not that surprising when you think about it, since the TPMS sends its data on the 315 Mhz UHF radio band.  Any radio receiver within a reasonable range should be able to receive the messages.  However, the messages received from a sensor on your own bike are about 100 times more frequent than messages received from other vehicles.

RedRambler

[VirginiaJim]

Wow!

[gPink]

Don't the new style sensors broadcast at a different Mhz?

[RedRambler]

<Don't the new style sensors broadcast at a different Mhz?>

I have a new sensor made by Schrader Electronics and it is marked 315 Mhz.  I think the new and old sensors probably use the same frequency and data formats, as they are interchangeable.

RR

[VirginiaJim]

It would have to be that way to work on the existing bikes.

[gPink]

Carry on then.

[just gone]

You would need to connect the data logger and then ride the bike around the block to give the tire sensors time to transmit.  They transmit about every minute or so when the bike is moving.  The sensor messages can then be reviewed.  The sensor ID will be readily apparent in the first four data bytes of the 0x695 messages.

First of all, great work RedR'!.  

 I'm curious about the sensors needing to be on the bike to get the ID. When I've finished balancing a wheel after a tire change and/or a sensor battery change, I've spun the wheel on the balancer a few feet away from the bike and the pressure showed up on the bike after a short interval of a minute or so. I've heard/read that the sensor (the original style that comes apart easily for those that wish to install a new battery) needs to be under pressure for it to "turn on" but I've also heard that it can be simply spun on the end of a string with roughly the same spin radius as the tire to check a replacement battery install. If you get the chance in your research RedR', see which of those statements are correct or if neither are. I guess I could do the same test (for the pressure, not the ID. but you said it's in the same data stream if one can read it), but I recently changed batteries so it's going to be a while until the next tire change, I wish I had thought of it at the time I did the last one.

[B.D.F.]

The sensor does not need to sense any pressure to 'turn on'. The string spinning thingie works fine although it has been my experience you will hit at least two COG members even after repeatedly saying (quite loudly) "Watch out, I am spinning a sensor here". After striking as many COG members as seems to be required, continue to spin the sensor with the bike's ignition turned on and the screen set to tire pressure; w/in one minute (post ALL COG strikes- it must be contiguous spinning), the display will flash a warning that there is now zero (0) pressure in the tire, which is absolutely correct. Turn the bike off, mount the sensor (Easy Boys!) in the wheel, mount the tire (Boys!) and inflate.

It is centripetal force that turns the tire pressure sensor on and the lack of same, plus a time delay, that turns it off. All of that is to conserve battery power so it can display the low battery warning after a few months rather than after a few weeks....

Brian

First of all, great work RedR'!.  

 I'm curious about the sensors needing to be on the bike to get the ID. When I've finished balancing a wheel after a tire change and/or a sensor battery change, I've spun the wheel on the balancer a few feet away from the bike and the pressure showed up on the bike after a short interval of a minute or so. I've heard/read that the sensor (the original style that comes apart easily for those that wish to install a new battery) needs to be under pressure for it to "turn on" but I've also heard that it can be simply spun on the end of a string with roughly the same spin radius as the tire to check a replacement battery install. If you get the chance in your research RedR', see which of those statements are correct or if neither are. I guess I could do the same test (for the pressure, not the ID. but you said it's in the same data stream if one can read it), but I recently changed batteries so it's going to be a while until the next tire change, I wish I had thought of it at the time I did the last one.

[RedRambler]

I personally could not get a new sensor (right out of the box) to turn on by simply spinning it.  I tried putting it inside a long sock and spinning it as fast as I could.  I then strapped it to a bicycle wheel with the bicycle upside down and tried turning the petals to spin the back tire.  Again, no luck.  Lastly, I tried taping the sensor to the rear tire of the Connie, and using the engine to spin the wheel.  I did get transmissions from the sensor inside the wheel, but not from the new one that I had taped to the spoke of the wheel.  That led me to believe that the sensor had to be under pressure to turn on.  The sensor I was using was one of the new ones.  I have not tried one of the older ones.

However, I won't dispute the success that others on the forum have had with this.  I've tried only one new style sensor.

RedRambler

[B.D.F.]

It sounds like you may not have had the sensor in the correct position to generate the force in the correct direction. ??  The force must be placed in- line with the air fill fitting; putting the sensor in the bottom of the sock almost certainly will not work.

What I use is a piece of string, tied around the stem so that when the sensor is spun, all the linear force (centripetal force to be exact) is along the axis of the tire valve, exactly as it is when the sensor is mounted in the tire.

Some have speculated that it is some part of the rotation that turns on the sensor but that is not correct; the only forces generated specifically through rotation would all nullify at highway speeds and the sensor would turn off. The only force left that the sensor can sense is acceleration. That is the scientific reasoning that explains it; the coward's way out is to look up the data for the Infenion SP 30 or Infenion SP 35 by tracking down the datasheet and reading it. 

Now, all of this applies to the older type sensors supplied by LDL. The newer, potted sensors may well use a different scheme although physics being what it is, I suspect they too use centripetal force to turn the sensor on. And while it <may> be possible that they also require some minimum amount of air pressure in addition to the acceleration to turn on, I doubt it because if built that way they would not sense a low pressure condition if used in a flat tire.

Brian

I personally could not get a new sensor (right out of the box) to turn on by simply spinning it.  I tried putting it inside a long sock and spinning it as fast as I could.  I then strapped it to a bicycle wheel with the bicycle upside down and tried turning the petals to spin the back tire.  Again, no luck.  Lastly, I tried taping the sensor to the rear tire of the Connie, and using the engine to spin the wheel.  I did get transmissions from the sensor inside the wheel, but not from the new one that I had taped to the inside of the wheel.  That led me to believe that the sensor had to be under pressure to turn on.  The sensor I was using was one of the new ones.  I have not tried one of the older ones.

However, I won't dispute the success that others on the forum have had with this.  I've tried only one new style sensor.

RedRambler

[VirginiaJim]

I knew this would make my brane hurt.

[B.D.F.]

C'mon Jim, you can keep up with this- just picture a 1930's gangster swinging a coin around, standing outside, being tough. Now mentally swap the coin for a TPS sensor and then swap the gangster for a tall, extremely handsome motorcycle rider and you will have it to a 'T'.

 

Brian

I knew this would make my brane hurt.

[sailor_chic]

The sensor does not need to sense any pressure to 'turn on'. The string spinning thingie works fine although it has been my experience you will hit at least two COG members even after repeatedly saying (quite loudly) "Watch out, I am spinning a sensor here". After striking as many COG members as seems to be required, continue to spin the sensor with the bike's ignition turned on and the screen set to tire pressure; w/in one minute (post ALL COG strikes- it must be contiguous spinning), the display will flash a warning that there is now zero (0) pressure in the tire, which is absolutely correct. Turn the bike off, mount the sensor (Easy Boys!) in the wheel, mount the tire (Boys!) and inflate.

It is centripetal force that turns the tire pressure sensor on and the lack of same, plus a time delay, that turns it off. All of that is to conserve battery power so it can display the low battery warning after a few months rather than after a few weeks....

Brian

Now that was rather funny!

[B.D.F.]

It was pretty funny in person too- just enough of a tap to scare them and get their attention but not enough to actually hurt them; otherwise what I like to think of as the 'funny zone'. Who am I kidding- it would be funny even if they got a little hurt but not too much of course.

There is no limit to the goodness that is the entire KiPass system or physics.... but mostly KiPass.

Brian

Now that was rather funny!

[speedracersworld]

Saw this on ebay $799 including the Laptop: http://www.ebay.com/itm/Kawasaki-Diagnostic-Tool-KDS3-Combo-KIT/171979720878?

[VirginiaJim]

It's located in Poland.  Would there be anything different about it vs one that would have gone to the US I wonder?

[RedRambler]

To update progress on the DIY TPMS programmer, I've determined that the Kawi uses the standard Unified Diagnostic Services (UDS) protocol for its diagnostic communications over the CAN bus.  That fact, along with some extremely helpful data from jwh20 on this forum, has enabled me to decode and understand most of the diagnostic messages I have seen.

So I am able to use my homemade tool to request virtually any data that the KDS tool can get.  Sensor readings from most of the sensors (throttle position, barometric pressure, water temp, battery voltage, etc) as well as counters for many significant events (communication failures, sensor failures, hours operated, and over-rev conditions).

Unfortunately, Kawasaki has utilized a security feature of the UDS protocol that requires an exchange of encrypted keys before requests to make any changes are allowed.  So we will be unable to actually program new sensors until we find a way to overcome the encryption.  I think I have a brute force solution that could work, but it will take some considerable time and programming.  In the mean time, jwh20 is working to solve this problem another way.  I'm still hampered by not having access to a KDS...

Any data encryption or software reverse engineering gurus out there?

[just gone]

Any data encryption or software reverse engineering gurus out there?

Hmm, well darn Red', I thought that was your title.

Joking aside, great work so far.
According to the owner's manual, there is a certain low voltage threshold where the linked brakes are disabled leaving the ABS still active in an effort to maintain safety and extend battery life. If you put that on your future research list, many here would appreciate it. That is to say if there where a way to electronically/or diagnostically turn off the linking of the brakes, well that would be interesting to many. Of course I'm assuming that the ECU sends that signal to the ABS ECU over the CAN bus?..
...and that what ever that signal is, could be faked?
 Yeah, pretty much talkin' out my rear about something that is way over my head.

[gPink]

Red, is that copyright encryption you're running into?