I’m reverse-engineering a set of 433.92 MHz TPMS sensors and need help confirming the packet format / protocol.
Known sensor IDs:
LF: 0CAD7FB4
RF: 0CAD7949
RR: 0CAD87D6
LR: 0CAD812E
What I already know:
- LF decodes cleanly and matches my handheld very closely: 208 kPa / 22 C on my RF decode vs 206 kPa / 22 C on the handheld.
- Packet appears to be 9 bytes:
ID[4] + flags[1] + pressure[1] + temp[1] + counter[1] + checksum[1]
- The checksum seems to be XOR of bytes 0–7.
- Pressure scaling appears close to 1.379 kPa per raw count.
- Temperature appears close to raw - 50 C.
- Some sensors decode cleanly, others mostly come through as corrupted/checksum-fail packets.
Can anyone confirm:
1. The exact sensor family / protocol these IDs belong to?
2. Whether the packet structure above is correct?
3. Whether pressure and temperature scaling above are correct?
4. Whether these sensors use different bit timings / data rates between wheels or sensor variants?
5. Whether Autel-triggered wake-up should produce an immediate RF reply, or if motion/pressure change is also needed?
6. Does the sensor transmit battery level?