Downtown Doug Brown

This post is going to be a bit different from my usual posts. It’s still about computers, but it’s about a different type of computer: the computer modules in my 2009 Dodge Ram 1500 pickup. Vehicles these days have lots of computers in them. I’ve historically been afraid to mess too much with them in fear of screwing them up. Something going wrong has much more serious consequences when it’s your vehicle, as opposed to a spare computer you’re dinking around with. I’m slowly getting more confident though.

One of the computer modules in modern vehicles listens to the radio waves for signals sent wirelessly by tire pressure sensors in order to make sure that all four tires are inflated to the correct pressure. TPMS stands for Tire Pressure Monitoring System. This blog post is going to be about the TPMS sensors and how I used some computer software/hardware tools to help diagnose a problem with them.

The Ram recently had to go to the shop to get a new PCM (powertrain control module) installed because one of its connectors somehow got water inside. This caused corrosion, and the 12V pin that powers the module apparently broke off due to the corrosion. I was going to try to replace it myself, but as soon as I saw the corrosion inside the connector I made the call to let the experts deal with it. This broken pin caused the vehicle to not even be able to crank the engine. When I got it back from the mechanic, he told me that the TPMS light was on. I’ve dealt with this annoying light so many times that I decided it would be something I could try to figure out on my own first.

I know TPMS sensors are all about vehicle safety, and that is excellent, but at the same time they can also be a real pain in the butt. They often give me fits during the winter. I’m not sure if it’s caused directly by snow/ice or just the weather being cold in general, but I often find that in the winter, the tire pressure sensors act up and the light comes on. Of course I check the tire pressures to be safe, but typically I find that the tires are perfectly fine and it’s something wrong with the sensors. When this happens, I can just drive to my destination, and the light eventually shuts off while I’m on my way there.

In this case, this was right during the middle of the summer, so cold temperatures were not the problem. Still, I drove it around for a while to give the computer a chance to re-learn the sensors. I did a lot of research and found that a lot of Chrysler vehicles in particular will re-learn the sensors automatically while you’re driving them, especially if you can go for 10 minutes without stopping.

Despite all of my efforts, the light just wouldn’t go out. It would blink on and off for a while, and then it would stay on solid. I noticed this was different from the normal “low tire pressure” error I see too. When the sensor is sensing a low tire pressure, it will briefly display “low tire” where the odometer would normally show up, and the TPMS light just stays on solid, rather than flashing.

The computers in the vehicle know what’s wrong when they show indicators like the tire light or the check engine light. You just need to figure out a way for them to tell you what’s wrong. There are several different methods to do this. I believe there’s a special combination you can do on my particular vehicle by turning the key on and off rapidly a few times so it will display the codes on the dash, but in my case I had a better solution. I have a USB OBD-II adapter that uses an ELM327-compatible chipset. This allows my laptop to talk with all of the electronic modules in the vehicle and read their error codes. You just plug it into the OBD-II diagnostics port that is hiding near the bottom of the dash.

There is a lot of software out there for doing this. It’s often best to go with something designed specifically for your type of vehicle because it will be more likely to give you manufacturer-specific diagnostic information. In my case, I’ve always liked Appcar DiagFCA for my truck. I have been able to use it to disable the horn honking when I lock the doors with the key fob, and also to activate the factory Mopar backup camera kit when I installed it myself, rather than pestering the local dealership about it.

Anyway, I ran Appcar and it told me that the only active diagnostic trouble code (DTC) was in the Wireless Control Module (WCM). The code was C1502 – Tire Pressure Sensor 2 Internal. Looking at the past stored codes on my WCM, it’s clear that C1501 through C1504 are the corresponding codes for the four tires. It sounds like this can be caused by a fault in the sensor, or the sensor not transmitting, perhaps due to a dead battery in the sensor. Clearly some of the other stored (but not active) codes were due to the PCM problem I described earlier.

Appcar was also able to show me a bunch of info from the four sensors. It was interesting to learn that each sensor has a unique ID. It makes sense. That’s how the vehicle knows which four sensors in the world it’s supposed to be listening to. I have modified the unique IDs in all of the sample images just to be safe. Appcar also showed me pressure readings, air temperature readings, and a bunch of other stuff. It showed me that sensors 1, 3, and 4 were working and showing good pressures: 41 psi, 41 psi, and 40 psi respectively, along with air temperatures of 83, 80, and 79 degrees Fahrenheit. The tires were a little overinflated (supposed to be 35), but that wouldn’t be causing the TPMS light to act up, at least on this vehicle. I did drop them down to 35 afterward though. Anyway, sensor 2 was showing up as 0 psi, and air temperature of 0. Okay, so it sounded like tire 2’s sensor (whichever tire that is) was the one that was acting up.

I came to the conclusion that I needed to take it to a tire shop. After all, these aren’t really designed to be replaced by the average Joe like me. I like to “DIY” stuff when I can, but this is again one of those situations where I’d rather let the experts deal with it. You have to break the bead of the tire and get inside the rubber to replace the sensor, at least on this type of vehicle. The sensor is in the wheel and is actually the thing that provides the little valve stem that you see sticking out of the wheel to add or remove air.

I don’t have a picture of the actual sensor handy, but here’s a link to a sensor on RockAuto. The tire shop is going to be much less likely to damage the tire in the process. They know what they’re doing. I don’t.

So far I have just followed the approach of “take it to the experts and let them deal with it” in this entire post, which doesn’t make for the most entertaining story, except for seeing the data in Appcar to prove that one of the sensors is bad. Here’s where it will get a little more interesting.

The Ram went off to the tire shop, where they actually found two sensors that were bad, and replaced both of them. The information available to me only indicated that one was bad, but perhaps another sensor was on its way out, and these guys are the tire experts, so I went with it. When it was done, the TPMS light was still on, but that is normal after you replace it, and they said to drive it for a while and the light would go out on its own.

Sure enough, it had the normal “tire pressure low” indicator that I’m used to dealing with. That was a change from what I had been seeing, so I was optimistic. I drove it around for a while. In 99.9% of tire pressure sensor replacements, this story would end here and the light would go out. But in my case, it stayed on for a long time. Eventually I heard a ding, and the indicator started blinking. It was back to the original problem again! I actually drove it around a bunch over the next few days to try to get the light to go out. It didn’t go out.

Now at this point, I probably could have just said screw it and taken it back to the tire shop to let them diagnose what’s wrong themselves. But that’s not the kind of person I am. I like to solve problems, and I like to learn new things while I’m solving them. So I decided to see if I could figure out what was going on with the tire sensors on my own. Plus, even if I couldn’t fix it myself, it could potentially help the people at the tire place track down the problem quicker if I could narrow it down for them.

I looked at the data with Appcar again. The DTC this time was C1503, so sensor 2 was no longer complaining. Now it was sensor 3. This verified that the tire shop had successfully replaced the bad sensor. But they said they replaced two sensors, and they definitely did — the two rear tires had brand new valve stems. But a second new sensor ID wasn’t showing up in the data that Appcar was reading from the WCM. Tire #3 was now showing a bad pressure (0.0689 bar = 0.1 psi), but still the old ID (63402507).

I would have expected a new sensor ID if the sensor had been replaced. I have also seen it’s possible to program some TPMS sensors with the same ID as an old one, but I doubted that was the case here because tire #2 had a new sensor ID. It would be silly for them to give me a new sensor ID on one new sensor, but do an ID clone for the other new sensor.

At this point, I decided to research what I could do to examine the TPMS sensors myself. That’s when I stumbled upon other posts such as this one, explaining I could use rtl_433 with an RTL-SDR dongle to capture the packets sent by the sensors. I had bought a few of the ezcap DVB-T dongles a long time ago for playing around with SDR, so I pulled one of them out and installed rtl_433 in Linux. My thought process was if I could find the other new sensor’s ID, I could use Appcar to manually program its ID into the truck’s WCM to fix the problem.

I played around a bit with various parameters to rtl_433, and settled on these after reading a bunch of posts including this one on Reddit.

rtl_433 -M level -Y autolevel -Y minmax -Y magest -M noise

I found a few other things on the 433 MHz spectrum around me, including someone’s Acurite 3-in-1 weather station and someone’s Oregon Scientific THR228N remote temperature monitor.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : 2022-08-19 19:31:24
model     : Acurite-Tower id        : 23905
channel   : A            Battery   : 1             Temperature: 28.0 C       Humidity  : 1 %           Integrity : CHECKSUM
Modulation: ASK          Freq      : 434.0 MHz
RSSI      : -19.7 dB     SNR       : 18.7 dB       Noise     : -38.4 dB
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : 2022-08-19 19:31:28
model     : Oregon-THR228N                         House Code: 179
Channel   : 2            Battery   : 1             Celsius   : 30.50 C
Modulation: ASK          Freq      : 434.0 MHz
RSSI      : -25.6 dB     SNR       : 9.6 dB        Noise     : -35.2 dB
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : 2022-08-19 19:31:28
model     : Acurite-3n1  message_type: 32          id        : 0x1E8B
channel   : A            sequence_num: 1           Battery   : 1             wind_speed: 0.0 mi/h      temperature: 87.3 F       humidity  : 28 %          Integrity : CHECKSUM
Modulation: ASK          Freq      : 434.0 MHz
RSSI      : -22.9 dB     SNR       : 13.1 dB       Noise     : -36.1 dB
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

I also played around with looking at 315 MHz because it was unclear to me whether my truck was 315 MHz or 433 MHz (I later figured out that Appcar was telling me it was 433 all along). Anyway, I had some trouble picking up the tire sensors, probably because I wasn’t using an antenna optimized for this process. I drove the truck a little bit, because I read that they go to sleep if the vehicle isn’t moving. Then I probably looked like a madman to my neighbors, walking around the truck holding my laptop and antenna near each wheel. I finally settled on driving around with my laptop recording all of the data, and I seemed to have better luck picking them up that way. So I wasn’t able to go tire by tire and use the signal strength to figure out which sensor was on which tire. That would have been cool though!

Other than occasional random packets from other cars as I was driving around, it was clear to me that I was only getting packets from 3 tire sensors: the 3 working sensors that Appcar was telling me the truck knew about.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : 2022-08-19 19:47:10
model     : Citroen      type      : TPMS          id        : 2dd0fd92
state     : 12           flags     : 0             repeat    : 2             Pressure  : 239 kPa       Temperature: 32 C         maybe_battery: 15         Integrity : CHECKSUM
Modulation: FSK          Freq1     : 433.9 MHz     Freq2     : 434.0 MHz
RSSI      : -19.8 dB     SNR       : 17.3 dB       Noise     : -37.1 dB
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : 2022-08-19 19:47:12
model     : Citroen      type      : TPMS          id        : 63402f84
state     : 12           flags     : 0             repeat    : 3             Pressure  : 232 kPa       Temperature: 31 C         maybe_battery: 30         Integrity : CHECKSUM
Modulation: FSK          Freq1     : 433.9 MHz     Freq2     : 434.0 MHz
RSSI      : -28.8 dB     SNR       : 8.8 dB        Noise     : -37.6 dB
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
time      : 2022-08-19 19:47:13
model     : Citroen      type      : TPMS          id        : 3b585935
state     : 12           flags     : 0             repeat    : 1             Pressure  : 235 kPa       Temperature: 31 C         maybe_battery: 35         Integrity : CHECKSUM
Modulation: FSK          Freq1     : 433.9 MHz     Freq2     : 434.0 MHz
RSSI      : -28.8 dB     SNR       : 7.5 dB        Noise     : -36.3 dB
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

I also occasionally saw some corrupted packets. Their IDs were just the three IDs above shifted by a hex digit (4 bits), and the model would show up as something other than Citroen. That was just a small error in decoding the packets that occasionally happened, and not a different sensor.

Now I was pretty confident something was wrong with one of the two new sensors, and there was nothing I could really do about it on my own. So I went to the tire place on Saturday morning to see if they could fix it. The guy who helped me was super nice and knowledgeable. He confirmed that he could read all four sensors with his handheld programmer, and they were all set up for 433 MHz. He showed me the IDs and I could definitely see that 3 of the IDs matched what Appcar and rtl_433 were showing me, but there was a 4th ID I had never seen before. He went ahead and plugged into the truck’s OBD-II port and used his programmer to write the IDs into the truck. This actually made the TPMS light go off, but I had a hunch that it wouldn’t fix it based on what rtl_433 had shown me, so I drove around for a while to see if the light would actually stay off.

Sure enough, 20 minutes later, the TPMS light started blinking again. I confirmed again with rtl_433 that the 4th sensor ID was nowhere to be found. I just wasn’t receiving messages from that sensor ID. By the way, at some point the sensor numbers 0-3 in Appcar got switched around. I think his programming tool assigned them to their “correct” indexes when it programmed them through the OBD-II port. Maybe they were incorrect on my truck after a previous tire rotation or something. But either way, moving them around didn’t change the results. It was still that one sensor ID that wasn’t transmitting.

So anyway, I took it back to the tire shop again. The guy honestly said he wasn’t surprised to see me back. He said he deals with sensor issues like this all the time. I tried not to geek out too much, which I am prone to doing, but I mentioned that I have an OBD scan tool as well as a device that can scan the 433 MHz frequency and they were both only seeing 3 sensors transmitting. This time he said he would reprogram both new sensors just in case. The process of reprogramming them actually assigned new IDs to them. He even let me take a picture of his programmer, so that I would be able to know which sensor was on which tire. Then he programmed the sensor IDs into the truck through the OBD-II port, which again turned the TPMS light off. The picture I took of his programmer also confirmed that both new sensors were definitely reporting a good pressure and air temperature, so the problematic sensor wasn’t fully “dead”.

I drove off again, this time thinking that maybe his act of reprogramming the bad sensor would fix the issue once and for all. He had mentioned that he could also try replacing the sensor that isn’t showing up, and if that still didn’t fix it I would probably have to go to a Dodge dealership to get it checked out.

20 minutes later, the light came back on again. Appcar confirmed that tire sensor #3 was reporting the 0.1 psi value like before, and rtl_433 still was only seeing packets from the 3 other tire sensors. But this time I was armed with the picture he had let me take. I knew it was the right rear tire sensor that was having problems.

So finally, I returned back to the shop. I was able to confidently say that the 3B5ABA04 sensor was not transmitting data properly. I showed him how Appcar was reading 0.1 psi on that sensor and around 35 on the others. He replaced that sensor with a new one and let me take one last picture of his programmer so I could see the ID of the new sensor. The TPMS light was on when I left, and he said that’s normal and it would turn off if everything was good — basically the same experience of how it was supposed to work when they originally replaced the two sensors.

30 seconds after I left the tire shop, the TPMS light turned off, and it’s been off ever since. I made sure to drive another 20 minutes to confirm it was going to stay off. Appcar now shows all four sensors, and rtl_433 also picks them all up. The problem is fixed! I went back one last time to let them know that the problem was finally solved and that the brand new sensor they changed out was indeed bad. Seems unlikely, but it’s bound to happen every now and then I guess.

I honestly had a lot of fun with this one. It was cool to be able to use my RTL-SDR dongle for something practical! I didn’t need rtl_433 to diagnose this because Appcar was also giving me relevant information, but it was sure handy to have more evidence of what was happening. rtl_433 helped rule out the problem being caused by my truck itself. It was nice being able to help the tire shop identify exactly which tire was the one with the problematic sensor. I suppose they could have just changed both, but that’s wasteful. I don’t know, maybe they had their own scan tool that they could have used to find the same info I did.

I still think it’s weird that the bad sensor was being picked up by their programming tool, but not the truck’s WCM (and rtl_433). I think the sensor was very subtly defective and had extremely bad signal range or something. It was working, but not well enough for anything other than their programming tool at ultra close range to pick it up. Or maybe the accelerometer or whatever it is in the sensor module that detects when the wheel is spinning was damaged, so it didn’t know when to wake itself up out of sleep. That’s probably more likely. I’m slightly disappointed that I wasn’t able to fix it all by myself, but there’s really nothing I could have done short of replacing the sensor, which is way outside of my capabilities. I’m thankful that the tire shop was cool about working with me to figure it out so I could learn something new. I’m glad I was the one who happened to receive this brand new weird “half-working” sensor, rather than some other poor soul! Lucky!

In hindsight, the data was telling me exactly what I needed to tell the tire shop right away. If the sensor had been transmitting properly, the WCM would have automatically picked it up while I was driving and the tire pressure light would have shut off on its own. I could have just told them the list of 3 sensors that were transmitting, and said the one that’s not in that list is the one that’s misbehaving and please try replacing it. But it’s also good to let them go through their normal diagnostic processes given that they have a ton more experience on this subject than I do!