The CAN bus won't take very well to putting just a resistor in the network. It definately won't communcate any intelligent messages (Supposedly the ECU knows your exact tire pressure from the TPMS module), and will probably prevent any other devices from communcating on the bus (like the ECU itself...)

Perhaps somewhere else inside the TPMS reciever module itself?

OverLOAD

 

I have access to all the Mazda manuals and wiring diagrams, if one of you folks that knows more about this than me wants to take a look...

 

There really isn't too much to look at.
You can't "spoof" the CAN buss. Not with a resistor, anyway.

 

Maniac, thanks, but we need a wiring diagram for a vehicle WITHOUT TPMS. Sometimes you get lucky and you can see the resistor. Sometimes you are not so lucky and have to tear the car apart, measure resistances etc. to find how much it is or where it is. I'm not saying this will work, just that it has for other systems in the past. You will probably have to involve a Mazda dealer though...

OverLOAD, I can understand where you are coming from, but I KNOW that the PCM pings the TPMS even when the module is not installed, and no errors come up. Assuming the harness is the same, the only reasonable conclusion is that there must be a resistor in there somewhere.

And the PCM does not use TPMS data at all. The only reason they are linked is for the speed signal from the ABS to the TPMS module. The PCM wouldn't care less if the TPMS dropped off the end of the earth...(figure of speech).

Happy hunting (for that resistor, if it exists)!!

 

Nice schematic.. Very simple, Power, CAN bus High, CAN bus Low, and ground.

The lack of that unit could either be a VIN related PCM control, causing it to not trigger the dashboard alert if your vin matches the 'non TPMS' vins, and you really don't want to change the VIN that the PCM/ECU thinks you have.. Or, it could be from a full system reset, or just triggered by the TPMS transmitting its pressure messages.

Until someone pulls the TPMS sender, and lets the ECU sit without power for a while to see if it re-initializes without the TPMS afterwards, it's not worth exploring other avenues, IMHO..

Anyone have any pictures of where the TPMS is acutally located in the car?

Regards,

OverLOAD

 

No resistor in non-TPMS cars. The wiring is the same, the module just isn't present.
You are probably thinking of a network terminator. CAN doesn't need them.
To reiterate, a non-TPMS car simply doesn't have the module. The diagram applies to ALL RX-8s.



I will attempt that this week.


Its right under the nav screen area.

SEE PICTURE ATTACHED

 

Hmmm, so looking at the wiring diagram Jeff posted, notice the TPMS system become functional when the ignition switch is turned on. I wonder what simply unplugging that connection (B/Y connected to pin K) would do? In theory, the TPMS might think the car is not running, and would not enable...

 

PCM: "Hey TPMS. what's going on over there?"
TMPS:" What do you mean?"
PCM:"Well, we started up and are running and you never turned on! Why?"
TPMS:"Well, I never got an ignition indication, so I'm waiting for the car to start."
PCM:"Uh, OK."

PCM then jumps on the phone and calls CEL

PCM:"Hey, CEL. TPMS just lost his mind. He thinks the car isn't even running and we are already going down the highway at 45 MPH."
CEL:"Well, its not really my job. That is the TPMS indicator's job. What should I do?"
PCM:"Well, he has lost his mind. I don't think he is going to set his own indicator. That is why I called you."
CEL:"I don't have a code for the TPMS. You are just going to have to convince him to set the light on his own. Sorry."

Bring up the bumper music
commercial for beer or tampons goes here...

 

Just what I needed, a bit of comic relief for my friday.. Perfect!

Seriously, pull ALL the connectors from the TPMS, including the bus lines. Someone with aftermarket wheels, and a never ending TPMS low warning lamp please try it.. The TPMS won't commuinicate then:

PCM: Hello? Hello? Is there a TPMS out there???
TPMS: ZZZzzzzz ZZZzzzzz
PCM: Anyone?
TPMS: ZZZzzzzz
PCM: Aw forget it.. Who needs a TPMS anyway, hey HVAC, what's cookin'?


OverLOAD

 

Unfortunately, that scenario goes thus:

PCM: "Hey, TPMS!"

silence

PCM: "TMPS? HELLO?"

nothing

PCM: "OH CRAP! Someone kidnapped TPMS! SOUND THE ALARM!!!"

 

Maybe you guys are getting too deep in the details....

If it just throws a dash LED, why not just "go for the light?"

Pull the gauge cluster, identify the LED, (it's the one that is lit up!)

Snipitty snip, or even 'snip/extend/switch' for an on/off control.
.
.
.
doc

 

If it works like the airbag light on Miatas, then the conversation would be:

PCM: Hey TPMS, how's it going?

TPMS: Not good, I'm not picking up any wheel transmitters. I think I'm going to have to blink the light.

PCM: Cool, talk to you later.

TPMS: Damn, the light isn't working! Crappy Japanese bulbs... time for the audio warning alarm!

(Beep... beep... beep... )

(If you try to disable the airbag warning light on a Miata, the airbag control system recognizes the bulb failure and sounds an audio alarm instead!)

Regards,
Gordon

 

Don't forget the ever present low pressure warning beeps..

Until someone actually tries it, it's still speculation. Who wants to try it?

OverLOAD

edit: try pulling the whole TPMS reciever/control module!!!

 

LOL!!! Jeff, and others, that was FUNNY!!! :D Is this "car nerd" humor? :D

Dangit, I keep looking for the SIMPLE solution...

 

On the Miata, you can pull the airbag computer as well and that stops the beeps and the light.
On the RX-8, pulling the instrument cluster is a big deal because it has a rather "special" relationship with the PCM.
The PCM will get very mad at you. (:

 

Is that CAN as in Controller Area Network?

If so:

(1) Has anyone hacked into the CAN bus to intercept or spoof messages?

(2) With the right tools, and access to the CAN bus, it may be possible to make the car believe the TPMS were there, and maybe hijack other portions of the car monitoring and control system.

 

A0: Yes.

A1: Yes. That's old news. I picked up a project back in october to make a CAN transciever, (very small form factor) that would hook into the car and be able to query the OBD.

A3: I've still got proto equipment that can talk to the RX-8 hanging around, and once I get done working on the Aux-in module, I'm going to pick this project back up. It's more than capable of spoofing the TPMS module, as well as any of the other CAN modules in the car. In fact, I probably already have messages logged from the TPMS, unfortunately, it's not easy to pick them up over the rest of the TONS of messages being sent out. I suspect that it's in there, just who knows where. I might find it by searching for the tire pressure values, but that might not be the correct one.

Sending the messages out on a periodic bases, once you know what they are, is trivial.

Plus, I'll wait for Maniac to tell us his results from removing the TPMS module completely from the bus, that might make all this spoofing talk completely unnecessary.

Regards,

OverLOAD

 

Been following this thread for some - and have little to add BUT I'm going up to Canada at the end of March - and my first dealer oil change will be there. Have an appt already - going to be asking about DRLs and now will ask about the TPMS. Will report back after that appt.

John

 

Good luck. Several of us have talked to dealerships about this, and have gotten no where. Hopefully you will!

 

OverLOAD --

Thanks for the info. I found more in the ODBII and CAN related threads. When I have developed with CAN in the past, we picked the codes, and for the RX-8, the codes aren't published -- That is a pretty significant barrier.

I concur its overkill for TPMS, but as you and others have already considered, getting on the network could be very useful. If it happened to also spoof TPMS, so much the better.

I live in Ann Arbor and have EE-lab and software tools, but no CAN tools. A collegue of mine has done several CAN projects, and knows about tools and may have some. But from what I have read, the current problem is codes, not tools.

 

My knowledge of this stuff is limited, but wouldn't the code numbers suffice?
Every possible diagnostic code is listed in the shop manual.

 

It depends on whether there are a CAN codes associated with TPMS results, or however that is reported. Do any of the codes specifically mention TPMS, tire pressure, etc?

If so, is there an associated data packet for that code, does it include decode information on the data?

Its possible there are different levels of the codes. For example a low level message reporting raw sensor status (sensor ok, sensor failed, pressure OK/fail, actual pressure, etc). At another level there could be a code that turns the light on or activates the beeper.

Until I read OverLOAD's reply today, I hadn't been thinking about an RX-8 in the CAN context. My questions above are generic, may miss the point, and may be more old news. Likely OverLOAD and the others will have a better sense about the manual, codes, etc.

 

Sure, I suppose if it came down to it, There'd really only be a few can messages you'd need to know:

1. Start up interrogation sequnce... Question/Reply for ECU/TPMS power up presence test

2. Regular message data type. Is it ECU initiated? Or is it just periodically TX'ed by the TPMS without any provoking on the part of the ECU.

The actual data messge is what you want to know.. Given time, it will all be unraveled.

OverLOAD

ps. I don't think that the service manual has any info about actual CAN messages.. It just references 'WMS' (?? is that right?) for testing..

 

was wondering if you could fool the sending unit or would you have to fool all four

 

Take a look at this thread.. This diagrams been shown before, but now that I looked at it again it makes more sense.

https://www.rx8club.com/showthread.p...401#post267401

Basically, pull the room fuse, and the TPMS looses power.. no tpms means no beeps. Long term solution is to either remove the tpms, or dsconnect its power souce.

Regards,

OverLOAD