Toyota TPMS china module reverse engineering

This small “box” caught my eye on AliExpress. It seems to change messages between the tire pressuere sensor receiver module and the dashboard / main body ECU.
The idea is, that you car which does not support showing tire pressures in the main instrument cluster, can show the values.. This seems to be controlled by the TPMS receiver and the messages it sends instead of by the dashboard itself.

So naturally after waiting for ~2 weeks for the thing to arrive from china, i opened it up and tried to reverse engineer it.
Here is a shot of the board with some annotations:

It´s a mostly single sided board, there are only two jumpers which are done by vias with a small trace on the back-side.
Otherwise the backside is used as a ground-plane.

The cable you get with the module is just pass-through for most pins and an Y-Cable for 12V (Blue), GND (Green) and 12V-Ignition (Black).
It mainly breaks out / intercepts Pin 4 (Yellow and White) on the connector, which seems to be some sort of a Single Wire Data transmission line / bus.

The CPU used on the board is a MM32F0010A1T which is a 32bit ARM-Cortex M0 MCU developed and made by a chinese manufacturer. It is advertised as a pin compatible replacement for a STM8S003F3P6, which has a similar pin-layout, but does only feature an 8bit non-ARM CPU Core.
The MCU and signals run on 3.3V which are generated by the left lower circuitry by a 5V linear regulator which converts 12V -> 5V and a following 3.3V Low Drop Out linear regulator (662K).

I have redrawn the relevant signal circuit in KiCAD it looks like this:

From the circuit we can tell, that the Databus seems to be 12V and pulled-low by the MCU via the two top transistor to send data.

Seems like the circuit can only Receive from the TPMS Receiver box and not pull the databus low, so i guess this is not a LIN-Bus as there would be some back and forth communication necessary between the master and the slave which is not possible with this circuit.

IMHO the TPMS module actively sends messages on Pin 4 of the connector once turned on without receiving anything. Our china-board receives these messages, modifies something in them and then proceeds to send the modified message to the cars main body ECU.

In the workshop manual the line intercepted by the china board is called “RDA” (light green Cable) and it is connected to the TPMS Receiver on Pin 4 and on the main body ECU on pin 10.
There is an adjacent line called PRG (gray cable) it´s connected to Pin 5 on the TPMS Receiver and on Pin 11 on the main body ECU. I suspect this line is used for data traveling from the main body ECU to the TPMS Receiver.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.