TPMS is a system installed on many modern cars (or retrofitted on older cars) that wirelessly monitors the tire pressure on vehicles in order to provide dashboard information that can improve safety and fuel economy. TPMS system typically transmit on license free bands, such as 315 MHz which can easily be received with an RTL-SDR.
Ross owns a 2008 Toyota Tacoma which has a built in TPMS system. Unfortunately he found that one of his sensors was broken as the TPMS warning light was consistently on, despite knowing that his tire pressure was correct.
Instead of purchasing an expensive TPMS diagnostic tool, Ross broke out his RTL-SDR and fired up rtl_433 which already contains a ready to use TPMS decoder. From the data received, Ross was able to determine that only three sensors were transmitting. Ross then goes on to use the RSSI signal power strength measurements provided by the rtl_433 output, while moving the antenna next to each wheel to determine exactly which wheel had the faulty sensor.
Ross's post goes into further details about his setup and the data he received from the sensors. He also created a follow up post, describing a bash script he wrote to automate the process.
Gerrit's weather station wirelessly displays data on a wirelessly connected LCD screen, but he notes how difficult it is to view historical data, or to graph trends. Having discovered that the rtl_433 RTL-SDR decoder supports his particular weather station (a Fine Offset Electronics WH1080/WH3080 compatible Weather Station (Alecto WS-4000)), Gerrit decided to write some code to log data to a SQL database, and display that data via a Python Dash.plotly web interface. The RTL-SDR, rtl_433 and custom software all run on a Raspberry Pi.
The interface allows Gerrit to view live and historical data all on neatly plotted graphs. HIs complete open source code can be found on Github.
Over on his YouTube channel CWNE88 has posted how he has been using and RTL-SDR with the rtl_433 software to explore the data coming in from various 433 MHz ISM band devices in his neighborhood. In the video he explains how he has set up rtl_433 on his Raspberry Pi, and what sort of data he is receiving. Some examples of devices he's received include various weather stations, doorbells, remotes and car tyre pressure monitors.
He also mentions how these signals are unencrypted, noting that in a future video he will show on GNU Radio how a false signal could be synthesized.
Nimrod makes his own sourdough and wanted a way to track the temperature and humidity of the bread making environment. To do this he's set up a system involving rtl_433 on a Raspberry Pi which live streams all of his home temperature/humidity sensor data into InfluxDB. The program rtl_433 is software for the RTL-SDR that allows users to receive data from many different brands of home weather/temperature sensors, as well as many other wireless ISM band devices. InfluxDB is a type of database that specializes in storing and displaying time series data from sources like sensors.
The chain of data starts with rtl_433 which collects the temperature sensor data via an RTL-SDR. The output of rtl_433 is sent to Mosquitto, an MQTT messaging protocol server. A program called Telegraf then subscribes to the MQTT queue, and parses and transmits the metrics to InfluxDB. InfluxDB finally records the data, and provides graphical plots.
Nimrod's post is a full tutorial showing how to download and set up each of the programs used in the system, and how to view the data collected with InfluxDBs graphing system.
To keep them away from humid air Scott uses "PrintDry" plastic vacuum canisters. Unfortunately he found that the vacuum sealing system wasn't perfect, and that some canisters would lose their vacuum after a few days. In order to ensure that the canisters were properly sealed he decided to add some active monitoring with pressure and humidity sensors and a wireless transmitter.
His monitoring system consists of a cheap 315 MHz ISM band transmitter, ATTINY85 microcontroller and pressure + humidity sensor. To receive and monitor the data he uses an RTL-SDR that runs the rtl_433 software, which is a program that is capable of decoding many different types of wireless ISM band sensors.
DIY Wireless Temp/Humid/Pressure sensors for measuring vacuum sealed 3d printed filament containers
Over on his YouTube channel Tech Minds has recently uploaded a video that demonstrates and shows how to use the rtl_433 software with an RTL-SDR to decode 433 MHz ISM band low power devices. Typically these devices include things like home wireless temperature and weather sensors, tire pressure sensors, remote controls, and other various sensors.
In the video he sets up an RTL-SDR and magmount antenna by his window and is able to receive data from several of his neighbors weather stations, and some car key remotes. He shows how to run the software on both Linux and on Windows.
How To Decode 433Mhz Low Power Devices Using RTL433 And A RTL-SDR Receiver
SimpliSafe is an American DIY home security system company that claims over 2 million customers. Their system relies on 433/315 MHz ISM band wireless radio communications between its various sensors, control panels and remote controls. Back in 2016 we already posted about research from Dr. Andrew Zonenberg and Micheal Ossmann who showed that the SimpliSafe wireless communications are unencrypted, and can easily be intercepted, decoded, and spoofed. SimpliSafe responded to those concerns by downplaying them and mentioning that sophisticated hardware was required.
Adam began with some initial manual RF analysis with an RTL-SDR, and then later worked with rtl_433 dev Christian Zuckschwerd to add PiWM demodulation capability, which is the modulation used by SimpliSafe systems. Now Adam is able to easily decode the serial number, pin codes, and status codes transmitted by SimpliSafe sensors and key pads in real time with just an RTL-SDR.
This is very concerning as not only could a burglar easily learn the alarm disarm pincode, but they could also profile your behavior to find an optimal time to break in. For example if you arm your alarm before bed, and disarm in the morning your sleep schedule is being broadcast. It is also possible to determine if a particular door or window has been left open. With a tuned Yagi antenna Adam was able to receive signals from 200+ feet (60m) in free space, and 115 feet (35m) through walls.
In addition to the lack of encryption, Adam also discovered that the SimpliSafe system was susceptible to jamming attacks, and that the tamper detection system can be easily compromised. Adam has disclosed all concerns and findings to SimpliSafe who are aware of the problems. They assure him that next generation systems will not suffer from these flaws. But unfortunately for current generation owners, the hardware will need to be eventually replaced as there is no over the air update capability.
Rtl_433 is an RTL-SDR compatible command line based tool for monitoring various 433 MHz ISM band devices, such as temperature sensors, weather monitors, TPMS, energy meters etc. A full list of support devices can be found on the rtl_433 Github.
Over on his blog “raspberrypiandstuff” mentions that he’s been using rtl_433 and an RTL-SDR on a remote headless Raspberry Pi to receive and monitor temperature and humidity from his weather station. From the data he’s able to produce some nice graphs that show changes over time.
However, one problem that he ran into was that the USB controller on the Raspberry Pi would sometimes hang. The only solution he’d previously found to fixing it was to physically disconnect and then reconnect the RTL-SDR. But now “raspberrypiandstuff” writes that he’s found a new solution which is to use a small C-program called usbreset.c. Combined with a bash script that detects which device the RTL-SDR is on the bus, this tool helps to automatically reset the USB on the Pi if it fails to keep the RTL-SDR logging 24/7 without physical intervention.
This may be a solution to look into if you’re experiencing similar issues with 24/7 monitoring on the Raspberry Pi. If you’re also interesting in rtl_433 monitoring, “raspberrypiandstuff” also has a post on creating a simple GUI for rtl_433.