Help needed hacking a BLE TPMS

Disclaimer: I have played around with Espruino some while ago and my JS and BLE knowledge may have gotten a bit rusty - so sorry for any stupid questions in advance.

I got a Chinese TPMS (tire pressure monitoring system) consisting of 4 coincell powered BLE enabled oversized valve caps and an iOS / Android App.
The sensors support pressures over 10 Bar, but the App doesn't allow warning thresholds beyond 6,4 and since I want to monitor my bike tires I am stuck here.
Espruino to the rescue! (so I thought) - so I started hacking.

I can see the Sensors appearing in the iOS LightBlue app from time to time. Name "TPMSn-xxxxx" with n being 1..4 and xxxxxx being the hex suffix of the device ID.
Each device reports 1 service, but any connection attempt times out.

So I got out my old Nordic development board with the Espruino port loaded and finally used this:

NRF.setScan(function(d){
  console.log(d);
}, {
  filters:[{
    services: ['fbb0']
  }]
});

to log this:

BluetoothDevice: {
  "id": "82:ea:ca:30:bc:95 public",
  "rssi": -53,
  "data": new Uint8Array([2, 1, 5, 3, 3, 176, 251, 19, 255, 0, 1, 130, 234, 202, 48, 188, 149, 0, 0, 0, 0, 121, 9, 0, 0, 85, 1]).buffer,
  "manufacturer": 256,
  "manufacturerData": new Uint8Array([130, 234, 202, 48, 188, 149, 0, 0, 0, 0, 121, 9, 0, 0, 85, 1]).buffer,
  "services": [
    "fbb0"
   ]
 }
BluetoothDevice: {
  "id": "83:ea:ca:40:bc:fb public",
  "rssi": -55,
  "data": new Uint8Array([2, 1, 5, 3, 3, 176, 251, 19, 255, 0, 1, 131, 234, 202, 64, 188, 251, 0, 0, 0, 0, 134, 9, 0, 0, 75, 1]).buffer,
  "manufacturer": 256,
  "manufacturerData": new Uint8Array([131, 234, 202, 64, 188, 251, 0, 0, 0, 0, 134, 9, 0, 0, 75, 1]).buffer,
  "services": [
    "fbb0"
   ]
 }
...

From time to time devices appear. But this is it.

When I actually try to connect a device using this code:

var gatt;
NRF.requestDevice({ 
  filters: [{ namePrefix: 'TPMS' }],
  timeout: 60000
}).then(function(device) {
  console.log(device);
  return device.gatt.connect();
}).then(function(g) {
  gatt = g;
  return gatt.getPrimaryService("fbb0");
}).then(function(service) {
  console.log("Service:" + service);
  return service.getCharacteristics();
}).then(function(characteristics) {
  return console.log(characteristics);
}).then(function() {
  gatt.disconnect();
  console.log("Done!");
});

• even with the service id as filter - I always time out.
  
  

I guess the device avoids connections to save power.
Or at least makes connections as brief as possible.

So my questions:

• Is there anything more I can try?
  
• Is it possible that the whole sensor data is contained in either "data" or "manufacturerData" already and the advertised service is not needed at all?
  
  
  
  
  

2 Attachments