BMW GEN5 TPMS (TSSRE4) – Data Comparison and Decoding

[austinroolon]

I tried to decode data from my BMW TSSRE4Db sensor. I received data with dongle RTL-SDR using RTL433.exe in commmand line. It was correctly decoded there as BMW 5th GEN sensor.

I am working on a receiver for BMW TPMS sensors using an ESP32-C3 and CC1101 module with the rtl_433_ESP library. Below is a detailed analysis of the captured frames. I am comparing the raw bitstream from a custom flex decoder (BMW_TSSRE4) with the system's built-in BMW-GEN5 decoder to verify data integrity and payload structure. I prepared libs for ordinary Arduino and manually set SPI PINS in lib. SPI looks workin correctly (on osciloscope). I received (CMD RTL_433.exe) as below but I can not decode it using this libs. Im using rtl_433_ESP-0.4.0. I couldnt find any demo sketch to implement ESP32xx+CC1101 FSK TPMS receiver.

Frame 1: Raw Data (Flex Decoder)

• Model: BMW_TSSRE4
• Length (len): 217 bits
• Data (HEX): aaaaaa5995955969aa556996aaa5556665aaa69a5565955a55aaff8
• Description: This represents the raw Manchester-encoded bitstream including the preamble (aaaaaa). It is useful for analyzing the physical layer and signal timing.

Frame 2: Decoded System Data (BMW-GEN5)

This is the output from the built-in decoder, which "cleaned up" the signal from Frame 1.

• Sensor ID: 26f069fc
• Pressure: 12.2 kPa
• Temperature: 27.0 °C
• Message (msg): 8826f069fc054fdb04830f
• Description: This is the "clean" payload. The Sensor ID (26f069fc) is clearly visible within the msg field. For bit analysis and troubleshooting, this string is the most valuable as it contains pure logical values without radio noise.

---

Frame 3: Raw Data (Second attempt by Flex decoder)

TPMS sensors typically transmit the same packet multiple times for redundancy. This is a repetition of Frame 1, but with a slightly different length (1 bit truncated at the end).

• Model: BMW_TSSRE4
• Length (len): 216 bits
• Data (HEX): aaaaaa5995955969aa556996aaa5556665aaa69a5565955a55aaff
• Description: Almost identical to Frame 1, missing only the trailing 8. In RF analysis, such 1-bit differences at the end of a transmission are common due to signal length rounding errors.

Frame 4: Decoded System Data (Repeat)

• Sensor ID: 26f069fc
• Pressure: 12.2 kPa
• Temperature: 27.0 °C
• Message (msg): 8826f069fc054fdb04830f
• Description: Data is identical to Frame 2. This confirms that the reading is stable and correct.

---

Additional Context:

The sensor was tested at a stable temperature of 27.0°C and low pressure (12.2 kPa), which matches the decoded output. These frames can be used to further refine the BMW-GEN5 protocol implementation or for testing CRC calculations.
Hardware Setup:
MCU: ESP32-C3 SuperMini
Radio: CC1101 (8-pin version)
Frequency: 433.92 MHz
Library: rtl_433_ESP (NorthernMan54)
#define RF_CC1101
#define OOK_MODULATION false
#define RF_MODULE_FREQUENCY 433.92 // BMW GEN5 standard 433.92
#define RF_MODULE_SCK 10
#define RF_MODULE_MISO 3
#define RF_MODULE_MOSI 1
#define RF_MODULE_CS 0
#define RF_MODULE_GDO0 7
#define RF_MODULE_GDO2 2
#define MINRSSI -100

in setup:
spi.begin(PIN_SCK, PIN_MISO, PIN_MOSI, PIN_CSN);
rf.initReceiver(PIN_GDO2, 433.92);
rf.setCallback(rtl433Callback, messageBuffer, MSG_BUF_SIZE);

    setReg(0x0B, 0x06); 
    setReg(0x10, 0xC8); //
    setReg(0x11, 0x93); // 9.6 kbps
    setReg(0x12, 0x06); // FSK, No Manchester 
    setReg(0x15, 0x34); 
    setReg(0x08, 0x02); 
    setReg(0x07, 0x32); // wide mode
    setReg(0x18, 0x18); // 
    setReg(0x19, 0x76); 


rtl_433_ESP::enableReceiver();