What signals does MyBMW App use to connect.

[turns2stone]

Ok - I'll give you an example. I just went out to my car and "woke it up" by sending a cab heating command to it. Then I sent a "flash headlights" command from the app. It took 26 seconds to react. Does that look like a real-time Internet of Things interaction? It doesn't to me.

Now... perhaps it's simply implemented very very badly. Or perhaps it's based on something really primitive. I guess we'll never know, because as I said earlier, all we have so far is assumption, not facts!

It took 26 seconds because it had to go on a very long path from your phone, to the carrier's IoT core, to BMW's servers, back to the car. I don't know where you are located, but the network data path (I described above) can literally be thousands of miles long, as those packets travel the country, even making redundant trips, especially if the packet transmission fails or gets corrupted and has to start all over again. It's not even uncommon for the request to physically start in Dallas, go to Atlanta, then to Chicago, then to Houston, then back to Dallas where your car is located. A dozen 'hops' is not uncommon, and we are talking hundreds of miles at a minimum, several thousand is not unexpected.

In fact, these phone-to-car delays are such a problem, Tesla recently rolled out an update that takes those commands from your phone to the car's bluetooth modem (when you're in physical range) for things like 'lock the doors'.

What I'm describing is not 'assumption' for how this works at a macro level, I do this for a living

 

[mojo]

Please don't misunderstand what I'm saying. You may know everything about how mobile phone communications work and I may know nothing, but the entirety of your interpretation of BMW's implementation is assumption. Any of us can do that.

Internet to SMS gateways are nothing new - they existed 20 years ago. In tech terms, that's not hard to do. They stopped making them available to the public (in the UK) a long time ago, but that was not for any technical reason - that was essentially because they made SMS spamming too easy...

Perhaps someday someone will uncover factual evidence about how it works. Until then, all we can do is guess!

 

[turns2stone]

Please don't misunderstand what I'm saying. You may know everything about how mobile phone communications work and I may know nothing, but the entirety of your interpretation of BMW's implementation is assumption. Any of us can do that.

Internet to SMS gateways are nothing new - they existed 20 years ago. In tech terms, that's not hard to do. They stopped making them available to the public (in the UK) a long time ago, but that was not for any technical reason - that was essentially because they made SMS spamming too easy...

Perhaps someday someone will uncover factual evidence about how it works. Until then, all we can do is guess!

I work for the carrier that (until recently) provided the IoT/telecommunications services for all BMW vehicles in my country. I encourage you to re-read my comments because there's no 'guessing' involved. And with that, I'm officially out! See you around

 

[mojo]

Well that is new information. You know how it actually works? I hope you're not officially out - we need people with actually knowledge.

Perhaps at a later date we can get more information from you - that would be good.

[Edited to add further context on the 26 seconds it takes for the car to react:

If I take an example of a server that's roughly a third of the way around the world from me, on a different continent: I picked the state of California's legislative assembly because it's likely to be hosted in California and not in a network content server round the corner from me. Traceroute shows the round-trip time to their servers is ~150ms for me in the UK, and it's 20 network hops away.

That's why I say that the response time does not suggest IoT to me in any way. As above - perhaps it's a really appalling implementation. But to me it looks more like it's based on a store-and-forward messaging system than any real-time session-based system.]

 

[alohart]

Ok - I'll give you an example. I just went out to my car and "woke it up" by sending a cab heating command to it. Then I sent a "flash headlights" command from the app. It took 26 seconds to react. Does that look like a real-time Internet of Things interaction? It doesn't to me.

I don't know the answer but I could make a few guesses. I doubt that an Internet connection between BMW's server and an i3 is maintained continuously. With so many connected BMW's, that would consume a lot of resources including the cellular phone company's data network. A continuous connection would discharge an i3's battery pack unnecessarily since so few messages are sent. My guess is that when a BMW server needs to send a message to a particular i3 like when a My BMW app sends a "flash headlights" message, the server must first establish an Internet connection with the i3's telematics module. With so many connected BMW's, messages might need to queue to share a common server resource. It might take several seconds for the message to reach the head of the queue where it can be sent. This probably requires the telematics module to awaken from sleep mode. Once the Internet connection is established, the "flash headlights" message can be sent. Depending on how busy BMW's server is, a message could take many seconds to be sent.

 

[BarryM]

Sorry chaps, I didn't realise that my simple question would generate so much 'discussion'

 

[mojo]

I don't know the answer but I could make a few guesses. I doubt that an Internet connection between BMW's server and an i3 is maintained continuously. With so many connected BMW's, that would consume a lot of resources including the cellular phone company's data network. A continuous connection would discharge an i3's battery pack unnecessarily since so few messages are sent. My guess is that when a BMW server needs to send a message to a particular i3 like when a My BMW app sends a "flash headlights" message, the server must first establish an Internet connection with the i3's telematics module. With so many connected BMW's, messages might need to queue to share a common server resource. It might take several seconds for the message to reach the head of the queue where it can be sent. This probably requires the telematics module to awaken from sleep mode. Once the Internet connection is established, the "flash headlights" message can be sent. Depending on how busy BMW's server is, a message could take many seconds to be sent.

Agreed - if they implemented it internally within the server as a queued system and didn't devote much resources to it then delays could be caused by the lack of resource, so that's another possible guess.

I should add that I'm not suggesting that a typical i3 uses only SMS. I know that's not the case, and that my car uses a 4G LTE mobile data for a couple of reasons:

1. Because it tells me that it does, if I ask it (and it tells me the approximate signal strength).
2. Because my car has OTA map updates (both the entire map and some map tiles), and it's unreasonable to suggest that a 30GB map download could take place over SMS.

So any company that provides telecommunications services for my BMW would certain see 4G mobile data traffic to and from my car. But that doesn't of course mean that 4G is the only method used.

The possible delay due to the TCM in the car waking up does also appear to be a factor. The 26 seconds that I recorded was with my car already "awake". I frequently see that the first attempt to send a "flash headlight" command to my car fails - almost as if it has been too slow to wake, and that subsequent commands succeed.

As said, we can guess, but until we find a source that tells us the facts, that's all that we are doing...

 

[alohart]

Sorry chaps, I didn't realise that my simple question would generate so much 'discussion'

Nothing to be sorry for. The discussion wasn't contentious like many these days. We were lucky to have a member with actual applicable experience.

 

[Gonville]

Has anyone ever confirmed that it uses SMS as the underlying messaging system? I've seen it stated many times but I've never been too sure whether that is assumption or fact.

It’s a fact. If you search on here someone did a reverse engineer in the olden days to show that the messages were passed in the clear. Thus resulted in a change to the message protocol to encrypt the content as knowing the VIN number an unlock command could be sent.

 

[Gonville]

Agreed - if they implemented it internally within the server as a queued system and didn't devote much resources to it then delays could be caused by the lack of resource, so that's another possible guess.

I should add that I'm not suggesting that a typical i3 uses only SMS. I know that's not the case, and that my car uses a 4G LTE mobile data for a couple of reasons:

1. Because it tells me that it does, if I ask it (and it tells me the approximate signal strength).
2. Because my car has OTA map updates (both the entire map and some map tiles), and it's unreasonable to suggest that a 30GB map download could take place over SMS.

So any company that provides telecommunications services for my BMW would certain see 4G mobile data traffic to and from my car. But that doesn't of course mean that 4G is the only method used.

The possible delay due to the TCM in the car waking up does also appear to be a factor. The 26 seconds that I recorded was with my car already "awake". I frequently see that the first attempt to send a "flash headlight" command to my car fails - almost as if it has been too slow to wake, and that subsequent commands succeed.

As said, we can guess, but until we find a source that tells us the facts, that's all that we are doing...

The control messages used SMS. 4G LTE allowed data transfer as you say.

 

[Gonville]

There's no suggestion that the car needs to send an acknowledgement back to you (in the app). The app converses with BMW's servers, not the car.

As already said, BMW's servers can put what they like in the SMS content. If they need more security, they can add security info at the start of the SMS that only the receiving TCM will accept. If you (or in this case BMW) control both ends of an SMS-based "conversation" then you can embed whatever you like in the SMS content - it doesn't have to be human readable.

As it stands, I've not seen any technical reason why SMS could not be used. You just need to bear in mind that the app is *not* conversing with the car - its "conversation" is entirely with a process running on one of BMW's servers. The SMS-based "conversation" would be on the other side of that process, and not accessible to the app.

Ok lets go to the end of this debate:-


When the Universal Mobile Telecommunications System (UMTS) is applied on top of GSM networks, the standard messaging protocol used is Short Message Service (SMS), which operates over the Signaling System No. 7 (SS7) network using the MAP (Mobile Application Part) protocol.

Check the BMW technical documents which say that UMTS is used.

(EDIT sorry wrong picture. )

 

[Gonville]

It’s a fact. If you search on here someone did a reverse engineer in the olden days to show that the messages were passed in the clear. Thus resulted in a change to the message protocol to encrypt the content as knowing the VIN number an unlock command could be sent.

When the Universal Mobile Telecommunications System (UMTS) is applied on top of GSM networks, the standard messaging protocol used is Short Message Service (SMS), which operates over the Signaling System No. 7 (SS7) network using the MAP (Mobile Application Part) protocol.

 

[Gonville]

This was from the pre LCI manual. 14.4kbps

 

[Gonville]

Because your app needs acknowledgement that the flash headlights request was received by the destination, and SMS doesn't support that. Plus, there's all kinds of security protocols needed for your flash headlights request, and again, SMS doesn't support anything like that.

Just to answer this part. To clarify (and I have posted the technical manual) that in the 3G version of the car - I.e. with limited bandwidth - the ‘command’ messages were sent, from the BMW server. There was no way to know if that message was delivered due to the lack of secure end to end protocol. So in 2014 there was no acknowledgement in the app. It was fire and forget. Sometimes a pre-condition worked sometimes it didn’t. For some commands, I.e. ‘lock’ the car would send a status update back to the server. But not all commands. This was the most complained about thing back then. No acknowledgement. Now myBMW does say ‘command delivered’ but I suspect that is for LTE/4G models which may have updated data link. Certainly in newer BMW i4 for example everything appears to be permanently connected in some way.

The SMS message would indeed have the VIN number in and a command number and a parameter. No need for security. (They did encrypt the messages later to stop someone unlocking the car about the time they changed the underlying protocols from iRemote to myBMW ap) Message sent to the car directly. The security was at the app end logging into the server as it is today.

I’d love to know what happens with the 3G/4G change over but suffice it to say in the UK pre LCI models will still have access to remote commands as our 2G network - which supports the SMS messaging - is staying active for a lot longer. 2030 I believe.

 

[turns2stone]

Ok lets go to the end of this debate:-


When the Universal Mobile Telecommunications System (UMTS) is applied on top of GSM networks, the standard messaging protocol used is Short Message Service (SMS), which operates over the Signaling System No. 7 (SS7) network using the MAP (Mobile Application Part) protocol.

Please site your source for this. While it’s accurate, I don’t believe it’s reflective of what BMW used to use.

Ok lets go to the end of this debate:-

Check the BMW technical documents which say that UMTS is used.

HSPA ≠ SMS.