You can’t see or hear the waves of electromagnetic radiation, that transmit everything from television shows to tire pressure information, traveling through the air. It is like magic how these radio waves work. So, how do you diagnose a radio wave? This has been a question asked by many technicians trying to resolve TPMS and keyless entry problems.

You can see the results of a radio wave using a scan tool by looking at the data stream when observing key fob button presses or codes being set by a missing TPMS sensor signal. But, how do you diagnose what happens between the transmitter and receiver if a signal is not sent or received? There are a couple of approaches and tools you can use.

A dedicated TPMS tool can force a sensor to transmit by emitting a transmission signal around 125Hz or above. You can also observe the data and information on the tool. Also, you can purchase probes for your scope that can sense radio waves. But, how do you learn about radio waves?

Hacking Radio Waves

A few months ago, “Flipper Zero” was trending on TikTok. The videos would show teens opening the charge flap on Teslas, garage doors and cars using a small device that looked like a child’s toy. I had to get one.

The Flipper Zero started life as a Kick Starter project by some engineers specializing in penetration testing (professional hackers). The device has receivers and transmitters for a broad spectrum of radio signals, including sub-GHz used for TPMS and keyless entry.

A Flipper Zero can detect the frequency of signals in the area, capture the raw signal and then emulate the signal. It can be used for good or evil. But, as an educational tool to learn about automotive radio waves, it is great.

The Basics

Radio waves are electromagnetic radiation that has organized wave patterns to communicate information. The frequency or amplitude is modulated to transmit data. They can also switch on and off to communicate. Radio frequencies are measured in units called Hertz, representing the number of cycles per second when a radio wave is transmitted. Depending on the number of oscillations, the frequencies are divided into bands. The FCC divides and regulates the spectrum by frequency.

The power or distance the signal can travel depends on several factors. First is the power of the transmitter. TPMS sensors typically have 3-volt batteries, so the transmission is not that powerful. As a result, the frequency for TPMS is in a range where travel over a distance of 10 feet is challenging. Also, the signal can be blocked by objects that have sufficient density, like a brake rotor, caliper or even the wheel. And, if two signals share a similar frequency, one signal can interfere with the other.

The part of the spectrum that vehicles use for TPMS and keyless entry is between 300-440MHz. This bandwidth is shared with radio-controlled toy cars, garage door openers and other low-power devices. Unfortunately, the low-power output of these transmitters makes them prone to interference from electrical devices that are not well shielded, like cheap cell phone chargers and appliances.

Using the Flipper Zero, I discovered a TPMS sensor transmits a very low-power signal that goes in all directions. The radio wave generated is absorbed and reflected off the vehicle and environment. The antenna on the vehicle, which could be on the windshield, in the wheel well or in other locations, receives part of the wave.

TPMS sensor signals are low power and frequency, with most sensors transmitting at 315MHz or 433MHz. But I also discovered that not all sensors transmit at exactly 315MHz or 433MHz. Some sensors will transmit at 319.415 or slightly above or below 315MHz. I am assuming they are doing this to avoid interference with other devices. Also, TPMS sensors do not transmit at the same time. When the signal is sent depends on the internal clock of each sensor. Even some high-end European models with antennas in the wheel wells, that transmit a frequency that causes a sensor to transmit when the vehicle is stationary, will stagger the radio wave poke, so signals do not transmit simultaneously.

There are a lot of consumer products in the 315-433MHz range, like home alarm systems and garage door openers. In some cases, electronic devices such as phone chargers can emit unintended electromagnetic radiation. The Flipper Zero can detect this interference.

The other thing I learned with the Flipper Zero is when TPMS sensors transmit. Most TPMS sensors will transmit when movement is detected through a simple accelerometer inside. If the wheel stops moving, the sensor will stop broadcasting after a programmed interval. With the Flipper Zero, I could shake or wave some sensors, and they would transmit.

I quickly deflated a tire with the Flipper Zero in frequency analyzer mode. Once a threshold was met, the sensor immediately sent a signal about the sudden loss in pressure. The Flipper Zero can capture the raw signal, which looks different from the regular status update. With the Flipper Zero, capturing and emulating the signal was possible to create a false TPMS warning.

A sensor never receives radio signals during regular operation. The only time a sensor receives a signal is when a TPMS tool activates the sensor by emitting an electromagnetic pulse. Also, some TPMS systems will have antennas and transmitters in the wheel well. Out of curiosity, I placed the Flipper next to the TPMS tool and sensor. I captured the lower frequency signal emitted by the tool and the response from the sensor.

So, what are TPMS sensors saying? Most TPMS sensors transmit three pieces of information that include the sensor’s ID number, pressure and temperature. Some sensors can transmit the status of the battery. It is impossible to decipher the signal with the Flipper Zero, but a TPMS tool can interpret what the signal is saying.

The TPMS system will not turn the light on if a single transmission is not received. Instead, it takes multiple missed signals. The system knows that a single missed or garbled transmission might be an external issue, like a sensor on another vehicle transmitting simultaneously or interference from the sensor behind a brake caliper. It is like a misfire monitor – it sets a code only if the problem reaches a specific threshold.

Is it possible to diagnose a radio wave? Yes and no. Detecting the presence of radio waves can help confirm the sensor is transmitting. But, the presence of a radio wave does not mean the antenna is receiving the signal. This can only be confirmed by looking at the results of the signal’s information. It could be a TPMS light being turned on or a door being unlocked. Troubleshooting the problem might require extra steps to eliminate potential issues with TPMS problems.

Radio Wave Diagnostic Tips

1. Perform relearns away from other vehicles and sources of electromagnetic interference like alarms and home appliances.
2. If a vehicle can’t receive signals from a sensor during a relearning process, try rolling the vehicle forward a few feet to unblock a sensor from behind a brake caliper or rotor.
3. To avoid radio frequency issues, try relearning sensor positions with a TPMS tool that can interface with the TPMS module through the OBDII port.
4. If a sensor can’t be activated with a TPMS tool, try rapidly deflating the tire by pushing in the valve stem. Then, hold the tool near the tire to see if the tool receives the sensor’s ID.
5. Do not retrain or program sensors around tire balancers and mounting machines. These machines cause sensors to transmit by deflating the tire rapidly.
6. Look for dash cams, radar detectors and cigarette lighter-powered devices mounted on the windshield. Often these devices can cause interference that can block the TPMS antenna.
7. On long vehicles like pickups and cargo vans, the distance from the sensor to the antenna is pushed to the limits. It can worsen if the truck is filled with cargo like steel pipes or sheet metal.
8. Look for other codes in other modules. A TPMS system might have a dedicated module, or it could be handled by a body control module if there are issues with how it communicates with other modules, like the instrument cluster.
9. Temperature matters to TPMS sensors. If you are dealing with an intermittent TPMS issue, it might come down to the battery’s condition inside the sensor. Since these batteries are a chemical reaction, low temperatures can slow the reaction. Often, the heat from the brakes will warm up a sensor so it can transmit.
10. Look for damage in the wheel well. Most high-end systems use multiple antennas that could be in the wheel well. Road debris, ice and crashes can damage these components. TS