Can You Diagnose a TPMS Radio Wave?

Can You Diagnose a TPMS Radio Wave?

There are a couple of approaches and tools you can use to diagnose a TPMS radio wave.

You can’t see or hear the waves of electromagnetic radiation, that transmit everything from television shows to tire pressure information, traveling through the air. It is like magic how these radio waves work. So, how do you diagnose a radio wave? This has been a question asked by many technicians trying to resolve TPMS and keyless entry problems.

You can see the results of a radio wave using a scan tool by looking at the data stream when observing key fob button presses or codes being set by a missing TPMS sensor signal. But, how do you diagnose what happens between the transmitter and receiver if a signal is not sent or received? There are a couple of approaches and tools you can use.

A dedicated TPMS tool can force a sensor to transmit by emitting a transmission signal around 125Hz or above. You can also observe the data and information on the tool. Also, you can purchase probes for your scope that can sense radio waves. But, how do you learn about radio waves?

Hacking Radio Waves

A few months ago, “Flipper Zero” was trending on TikTok. The videos would show teens opening the charge flap on Teslas, garage doors and cars using a small device that looked like a child’s toy. I had to get one.

The Flipper Zero started life as a Kick Starter project by some engineers specializing in penetration testing (professional hackers). The device has receivers and transmitters for a broad spectrum of radio signals, including sub-GHz used for TPMS and keyless entry.

A Flipper Zero can detect the frequency of signals in the area, capture the raw signal and then emulate the signal. It can be used for good or evil. But, as an educational tool to learn about automotive radio waves, it is great.

The Basics

Radio waves are electromagnetic radiation that has organized wave patterns to communicate information. The frequency or amplitude is modulated to transmit data. They can also switch on and off to communicate. Radio frequencies are measured in units called Hertz, representing the number of cycles per second when a radio wave is transmitted. Depending on the number of oscillations, the frequencies are divided into bands. The FCC divides and regulates the spectrum by frequency.

The power or distance the signal can travel depends on several factors. First is the power of the transmitter. TPMS sensors typically have 3-volt batteries, so the transmission is not that powerful. As a result, the frequency for TPMS is in a range where travel over a distance of 10 feet is challenging. Also, the signal can be blocked by objects that have sufficient density, like a brake rotor, caliper or even the wheel. And, if two signals share a similar frequency, one signal can interfere with the other.

The part of the spectrum that vehicles use for TPMS and keyless entry is between 300-440MHz. This bandwidth is shared with radio-controlled toy cars, garage door openers and other low-power devices. Unfortunately, the low-power output of these transmitters makes them prone to interference from electrical devices that are not well shielded, like cheap cell phone chargers and appliances.

Using the Flipper Zero, I discovered a TPMS sensor transmits a very low-power signal that goes in all directions. The radio wave generated is absorbed and reflected off the vehicle and environment. The antenna on the vehicle, which could be on the windshield, in the wheel well or in other locations, receives part of the wave.

TPMS sensor signals are low power and frequency, with most sensors transmitting at 315MHz or 433MHz. But I also discovered that not all sensors transmit at exactly 315MHz or 433MHz. Some sensors will transmit at 319.415 or slightly above or below 315MHz. I am assuming they are doing this to avoid interference with other devices. Also, TPMS sensors do not transmit at the same time. When the signal is sent depends on the internal clock of each sensor. Even some high-end European models with antennas in the wheel wells, that transmit a frequency that causes a sensor to transmit when the vehicle is stationary, will stagger the radio wave poke, so signals do not transmit simultaneously.

There are a lot of consumer products in the 315-433MHz range, like home alarm systems and garage door openers. In some cases, electronic devices such as phone chargers can emit unintended electromagnetic radiation. The Flipper Zero can detect this interference.

The other thing I learned with the Flipper Zero is when TPMS sensors transmit. Most TPMS sensors will transmit when movement is detected through a simple accelerometer inside. If the wheel stops moving, the sensor will stop broadcasting after a programmed interval. With the Flipper Zero, I could shake or wave some sensors, and they would transmit.

I quickly deflated a tire with the Flipper Zero in frequency analyzer mode. Once a threshold was met, the sensor immediately sent a signal about the sudden loss in pressure. The Flipper Zero can capture the raw signal, which looks different from the regular status update. With the Flipper Zero, capturing and emulating the signal was possible to create a false TPMS warning.

A sensor never receives radio signals during regular operation. The only time a sensor receives a signal is when a TPMS tool activates the sensor by emitting an electromagnetic pulse. Also, some TPMS systems will have antennas and transmitters in the wheel well. Out of curiosity, I placed the Flipper next to the TPMS tool and sensor. I captured the lower frequency signal emitted by the tool and the response from the sensor.

So, what are TPMS sensors saying? Most TPMS sensors transmit three pieces of information that include the sensor’s ID number, pressure and temperature. Some sensors can transmit the status of the battery. It is impossible to decipher the signal with the Flipper Zero, but a TPMS tool can interpret what the signal is saying.

The TPMS system will not turn the light on if a single transmission is not received. Instead, it takes multiple missed signals. The system knows that a single missed or garbled transmission might be an external issue, like a sensor on another vehicle transmitting simultaneously or interference from the sensor behind a brake caliper. It is like a misfire monitor – it sets a code only if the problem reaches a specific threshold.

Is it possible to diagnose a radio wave? Yes and no. Detecting the presence of radio waves can help confirm the sensor is transmitting. But, the presence of a radio wave does not mean the antenna is receiving the signal. This can only be confirmed by looking at the results of the signal’s information. It could be a TPMS light being turned on or a door being unlocked. Troubleshooting the problem might require extra steps to eliminate potential issues with TPMS problems.

Radio Wave Diagnostic Tips

  1. Perform relearns away from other vehicles and sources of electromagnetic interference like alarms and home appliances.
  2. If a vehicle can’t receive signals from a sensor during a relearning process, try rolling the vehicle forward a few feet to unblock a sensor from behind a brake caliper or rotor.
  3. To avoid radio frequency issues, try relearning sensor positions with a TPMS tool that can interface with the TPMS module through the OBDII port.
  4. If a sensor can’t be activated with a TPMS tool, try rapidly deflating the tire by pushing in the valve stem. Then, hold the tool near the tire to see if the tool receives the sensor’s ID.
  5. Do not retrain or program sensors around tire balancers and mounting machines. These machines cause sensors to transmit by deflating the tire rapidly.
  6. Look for dash cams, radar detectors and cigarette lighter-powered devices mounted on the windshield. Often these devices can cause interference that can block the TPMS antenna.
  7. On long vehicles like pickups and cargo vans, the distance from the sensor to the antenna is pushed to the limits. It can worsen if the truck is filled with cargo like steel pipes or sheet metal.
  8. Look for other codes in other modules. A TPMS system might have a dedicated module, or it could be handled by a body control module if there are issues with how it communicates with other modules, like the instrument cluster.
  9. Temperature matters to TPMS sensors. If you are dealing with an intermittent TPMS issue, it might come down to the battery’s condition inside the sensor. Since these batteries are a chemical reaction, low temperatures can slow the reaction. Often, the heat from the brakes will warm up a sensor so it can transmit.
  10. Look for damage in the wheel well. Most high-end systems use multiple antennas that could be in the wheel well. Road debris, ice and crashes can damage these components. TS

You May Also Like

Refrigerant Oil Has to Be Right

Oil type is just as important as oil capacity.

Three bottles of refrigerant oil

Air conditioning (A/C) is like electricity. It can be one of the more difficult things to grasp because there’s a lot going on behind the scenes. The physical components are easy to understand; we can remove and replace them all day long. But just like electricity has resistance, voltage and current flow, A/C has temperature and pressure relationships and there’s a lot of science involved in the theoretical operation.When we focus on the refrigerant oil itself, it’s had its share of misconceptions over the years and it didn’t help that A/C systems of old, i.e., R-12 systems, were a little more forgiving on the service side of things. But, you can throw that all out the window, and the only thing that matters now with today’s A/C systems, the oil, as well as the refrigerant capacities, leave no room for error.Over the past 30 years, A/C has been continuously evolving. Different refrigerants aside, the most obvious change has been the volume of refrigerant which the systems require. It’s half, and in some cases less than half of what they used to be, meaning today’s systems must operate much more efficiently (that scientific stuff) in order to cool the same or better as they used to. The best part is, they do! They’re getting the job done with half the juice, but what about the oil capacity? It’s also approximately half of what it used to be.Since the oil lubricates the compressor, is half enough? And, how does the oil charge affect the efficiency of the rest of the system? With most older compressors, only about 50% of the system oil capacity was present in the compressor at any point. It would naturally collect in the case, but they didn’t have a specific means to retain it, so it was picked up by the refrigerant and carried continuously around the system. Larger oil capacities ensured there was always enough to supply the compressor.Modern compressors feature oil retention technology to keep more oil within the compressor case itself, and today’s compressors retain approximately 75% of the oil capacity of the system. When adequate oil is retained in the compressor, less is needed in the system, and the overall oil capacity is greatly reduced.Reducing the amount of oil is one of the reasons that we have been able to achieve increased efficiency with less refrigerant. Oil creates a thermal lining on the surface of the evaporator and condenser, which reduces the heat exchange efficiency of the components. By reducing the amount of oil coating the inside surfaces, heat exchange efficiency is increased, so less refrigerant can be used to obtain the same result.The accumulator connection: Orifice tube systems utilize an accumulator after the evaporator (as opposed to expansion valve systems that utilize a receiver/drier after the condenser). Since compressors are not able to compress liquid, the purpose of the accumulator is to capture any excess liquid refrigerant that exits the evaporator (a normal characteristic of orifice tube systems), and it also plays a critical role in compressor lubrication and cooling. Any liquid refrigerant and oil that enter the accumulator drops to the bottom. A tube inside the accumulator picks up the refrigerant vapor from the top, loops down to the bottom and back up to exit again from the top. At the base of this tube is a small orifice. The orifice allows the vapor to pick up small amounts of liquid refrigerant and oil that have collected at the bottom and carry it back to the compressor, replenishing the oil and providing additional cooling to the compressor.This is critical because if a system is undercharged, there won’t be any excess liquid refrigerant exiting the evaporator. If no liquid refrigerant covers the base of the tube inside the accumulator, it won’t pick up the oil to return it to the compressor.Sticking together: Refrigerant oil gets easily carried throughout the system in the liquid refrigerant, however a change in chemical state occurs when refrigerant evaporates. On old R-12 systems, the R-12 refrigerant and oil molecules had a strong attraction when evaporation occurred, so the oil would stick to the vapor molecules and get carried back to the compressor.A big change that occurred starting with the R-134a systems, was that the refrigerant carries the oil along when in a liquid state, but when it evaporates, it doesn’t retain a strong bond with the oil. Some hangs on, but some doesn’t. As the refrigerant charge gets low over time, the liquid refrigerant in the evaporator also gets lower, and the oil tends to drop out and pool in the bottom of the evaporator. This causes a lack of lubrication at the compressor.

Open Up Your Scan Tool Options

Buying a scan tool can be difficult.

Testing is a Tool

Testing sure has become a lot easier with time.

pencil writing on test
Let Me Get My Violin

We find ourselves playing the role as listeners, counselors, advisors, and compassionate, caring people.

How Accurate Is Your Click-Style Torque Wrench?

Due to how the click-style wrench makes the click, it can lose its factory calibration.

Torque wrench

Other Posts

Inside the Tool: How Wrenches are Made

Today’s tools are built to withstand levels of stress well above that of years ago.

Hot Billets Ready for Forging. Courtesy Beta Tools
Change is Coming, Join the Ride

TechShop has launched two new video series, and one video podcast series.

Photo of Nadine Battah
Programming Options

Let’s help keep the code secure and your sanity intact.

CAN Bus Communications

There are three types of bus configurations that you will come in contact with — loop, star and a hybrid of both.

There are three types of bus configurations that you will come in contact with — loop, star and a hybrid of both.