GB2639565A - Tire monitoring devices - Google Patents

Abstract

Disclosed is a method of confirming configuration data stored in a plurality of tire monitoring devices. The method includes determining, at each of the plurality of tire monitoring devices, an indication to be provided by an indicator of the tire monitoring device, the indication based on configuration data stored by the tire monitoring device. The method includes providing synchronously, at each of the plurality of tire monitoring devices, the respective indication using the indicator of the tire monitoring device. The method includes, when the indications provided by each of the plurality of tire monitoring devices are the same, confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same.

Description

TIRE MONITORING DEVICES

TECHNICAL FIELD

[0001] The present invention relates to a method of confirming configuration data stored in a set of tire monitoring devices.

BACKGROUND

[0002] Confirming tire pressure is an important part of the maintenance of a vehicle. Tire pressures should be maintained at predetermined pressures to ensure that a tire performs as intended by the manufacturer. Incorrect tire pressure can lead to a tire failing, perhaps bursting and causing damage to the vehicle and/or a loss of control.

SUMMARY

[0003] A first aspect of the present invention provides a method of confirming configuration data stored in a plurality of tire monitoring devices, the method comprising determining, at each of the plurality of tire monitoring devices, an indication to be provided by an indicator of the tire monitoring device, the indication based on configuration data stored by the tire monitoring device; providing, synchronously at each of the plurality of tire monitoring devices, the respective indication using the indicator of the tire monitoring device; and when the indications provided by each of the plurality of tire monitoring devices are the same, confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same.

[0004] Providing the respective indication may be synchronised between the tire monitoring devices in any suitable way. For example, it may be synchronised with a start time by reference to a common time reference shared by the tire monitoring devices. Alternatively or additionally, the synchronous display may be triggered by a received command to transmit the code. Reference to synchronously includes cases where there is not exact synchrony, such as within 100 ms, within 50ms, or within 20ms of each other.

[0005] The method may comprise, when the indications provided by the plurality of tire monitoring devices are not the same, determining that the configuration data stored in each of the plurality of tire monitoring devices is not the same.

[0006] The indications may comprise visual indications. The indicators may comprise visual indicators. The visual indicators may comprise multi-purpose visual indicators, for example visual indicators configured to provide functionality in addition to providing the indication.

[0007] The visual indicators may comprise light sources. The method may comprise selectively illuminating the light sources to provide the indications. Each indicator may comprise a Light Emitting Diode (LED). Each indicator may comprise an LED capable of emitting more than one colour of light. Each indicator may comprise a red, green and blue (ROB) LED.

[0008] Determining the indication to be provided may comprise determining a length of time of an illumination of the respective light source. The method may comprise confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same where a length of time of corresponding illuminations of each light source is the same.

[0009] The length of time of the illumination of the respective light source may be at least 0.5 seconds, at least 1 second, at least 2 seconds, or at least 5 seconds.

[0010] Determining the indication to be provided may comprise determining a colour of an illumination of the respective light source. The method may comprise confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same where a colour of corresponding illuminations of each light source is the same.

[0011] Determining the indication to be provided may comprise determining a sequence of illuminations of the respective light source. A sequence of illuminations of the respective light source may comprise a sequence of different coloured illuminations of the light source and/or a sequence of illuminations and one or more periods of non-illumination. The method may comprise confirming that the configuration data stored in each of the plurality of tire monitoring device is the same where a sequence of illuminations of each light source is the same.

[0012] The sequence of illuminations of the respective light source may comprise illuminations having a time of illumination that is a multiple of a base value time of illumination. The sequence of illuminations of the respective light source may comprise one or more periods of non-illumination having a length of time that is a multiple of the base value time of illumination. The base time value of illumination may be 1 second, 2 seconds, 5 seconds, or 10 seconds.

[0013] The sequence of illuminations of the respective light source may comprise a repeating sequence of illuminations of the light source.

[0014] The sequence may have a length of no more than 60 seconds, for example no more than 50 seconds, no more than 40 seconds, or no more than 30 seconds.

[0015] The sequence may have a length of no less than 10 seconds, for example no less than 20 seconds, or no less than 30 seconds.

[0016] For each of the plurality of tire monitoring devices, the indication may comprise a period of illumination of the light source of the tire monitoring device, and a period in which the light source is turned off during illumination of each of the light sources of the others of the plurality of tire monitoring devices. Each of the plurality of tire monitoring devices may be configured to determine an expected indication to be provided by each other of the plurality of tire monitoring devices.

[0017] The method may comprise providing the respective indications in response to receipt of a request to check the configuration data at the plurality of tire monitoring devices. The request to check the configuration data at the plurality of tire monitoring devices may comprise a request received from an untrusted device, for example an untrusted intermediate device, such as a smartphone, tablet or other computing device. The request to check the configuration data at the plurality of tire monitoring devices may be submitted by a user, for example a trusted user, using the untrusted device. Each of the plurality of tire monitoring devices may determine the start time in response to receipt of the request to check the configuration data at the plurality of tire monitoring devices. Provision of the respective indications may be synchronised in response to receipt of the request to check the configuration data at the plurality of tire monitoring devices.

[0018] The plurality of tire monitoring devices may each comprise a first transceiver operable using a communication protocol having a range of at least 20m, at least 50m, or at least 75m and/or the plurality of tire monitoring devices may each comprise a second transceiver operable using a communication protocol having a range of less than 5m, less than 2m, less than lm, less than 50cm, less than 30cm or less than 15cm.

[0019] The request to check the configuration data at the plurality of tire monitoring devices may be received at the plurality of tire monitoring devices via a long range communication protocol, for example a communication protocol with a range of at least 20m, at least 50m, or at least 75m. Suitable communication protocols include Bluetooth. [0020] The request to check the configuration data at the plurality of tire monitoring devices may be received at the plurality of tire monitoring devices via a short range communication protocol, for example a communication protocol with a range of less than 5m, less than 2m, less than lm, less than 50cm, less than 30cm or less than 15cm. Suitable communication protocols include Near Field Communication (NFC).

[0021] The method may comprise waking each of the plurality of tire monitoring devices from a sleep mode, and providing the indication at the respective tire monitoring device where the request to check the configuration data is received within a pre-determined time period from the tire monitoring device being woken from the sleep mode. The predetermined time period may be at least 5 minutes, at least 10 minutes, or at least 15 minutes. The method may comprise waking each of the plurality of tire monitoring devices from its respective sleep mode using the short range communication protocol, for example using NFC. The method may comprise waking each of the plurality of tire monitoring devices from its respective sleep mode using the untrusted device.

[0022] The method may comprise stopping providing the respective indication in response to receipt of a request to stop providing the respective indication at the plurality of tire monitoring devices. The request to stop providing the respective indication at the plurality of tire monitoring devices may only be validly received after a pre-determined time period has passed since start of provision of the respective indication. The predetermined time period may be at least 10 seconds, at least 20 seconds, or at least 30 seconds. The predetermined period may additionally or alternatively be a length of the indication, so that the indication cannot be stopped until at least one whole indication has been provided.

[0023] The request to stop providing the respective indication at the plurality of tire monitoring devices may comprise a request received from an untrusted device, for example an untrusted intermediate device, such as a smartphone, tablet or other computing device. The request to stop providing the respective indication at the plurality of tire monitoring devices may be submitted by a user, for example a trusted user, using the untrusted device.

[0024] The request to stop providing the respective indication at the plurality of tire monitoring devices may be received at the plurality of tire monitoring devices via a long range communication protocol, for example a communication protocol with a range of at least 20m, at least 50m, or at least 75m. Suitable communication protocols include Bluetooth.

[0025] The request to stop providing the respective indication at the plurality of tire monitoring devices may be received at the plurality of tire monitoring devices via a short range communication protocol, for example a communication protocol with a range of less than 5m, less than 2m, less than 1 m, less than 50cm, less than 30cm or less than 15cm. Suitable communication protocols include Near Field Communication (NFC). [0026] Confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same may take place by an operator using an untrusted device, for example such as the untrusted device previously described. Confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same may comprise a corresponding user input at the untrusted device and/or transmission and receipt of the request to stop providing the respective indication at the plurality of tire monitoring devices.

[0027] The configuration data may comprise at least one of: a reference pressure of a tire of wheel to which the tire monitoring device is to be affixed in use; an on-aircraft wheel position of the respective tire monitoring device; an aircraft identifier; and a cryptographic parameter associated with at least one of the respective tire monitoring device and the set of tire monitoring devices.

[0028] Determining the indication to be provided by the indicator of the tire monitoring device may comprise utilising a hash of the configuration data. Determining the indication to be provided by the indicator of the tire monitoring device may comprise utilising a hash of one or more keys and/or security codes stored as configuration data by the respective ti re monitoring devi ces.

[0029] The method may be performed when the plurality of tire monitoring devices are not installed on an aircraft.

[0030] The method may be performed when the plurality of ti re monitoring devices are installed on an aircraft. The method may be performed for a plurality of sets of tire monitoring devices installed on an aircraft.

[0031] The configuration data may be first configuration data and may comprise a cryptographic parameter. The method may further comprise transmitting, from a subset of fewer than all of the plurality of tire pressure monitoring devices, a configuration data signal which encodes respective second configuration data, wherein the second configuration data comprises a reference pressure of a tire of a wheel to which the respective tire monitoring device is to be affixed in use.

[0032] The plurality of tire monitoring devices may comprise tire pressure monitoring devices. The tire pressure monitoring devices may each comprise a pressure sensor. The tire pressure monitoring devices may each comprise a temperature sensor.

[0033] A second aspect of the present invention provides a set of tire monitoring devices, each of the set of tire monitoring devices configured to: determine, based on configuration data stored by the tire monitoring device, an indication to be provided by an indicator of the tire monitoring device; and provide, synchronously at a start time, at each of the set of tire monitoring devices, the respective indication using the indicator of the tire monitoring device.

[0034] A third aspect of the present invention provides a tire monitoring device for use in a set of tire monitoring devices according to the second aspect of the present invention. [0035] A fourth aspect of the present invention provides an aircraft comprising at least one of a set of tire monitoring devices according to the second aspect of the present invention, and a tire monitoring device according to the third aspect of the present invention.

[0036] Optional features of aspects of the present invention may be equally applied to other aspects of the present invention, where appropriate.

BRLEF DESCRIPTION OF THE DRAWINGS

[0037] Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [0038] Figure 1 shows a schematic view of a fire pressure monitoring device; [0039] Figure 2 shows a schematic view of an aircraft incorporating a number of tire pressure monitoring devices as shown in Figure 1; [0040] Figure 3 shows a schematic view of a network of tire pressure monitoring devices; [0041] Figure 4 shows the network of tire pressure monitoring devices of Figure 3 with private-public key pairs and random numbers generated; [0042] Figure 5 shows the network of tire pressure monitoring devices of Figure 3 broadcasting a first message to one another; [0043] Figure 6 shows the network of tire pressure monitoring devices of Figure 3 broadcasting a second message to one another; [0044] Figure 7 shows the network of tire pressure monitoring devices of Figure 3 broadcasting a third message to one another; [0045] Figure 8 shows illustrative flashing sequences for LEDs of the tire pressure monitoring devices of Figure 1 to show device reference pressure configuration; [0046] Figure 9A shows a user interface for initiating a device reference pressure first digit configuration check; [0047] Figure 9B shows a user interface for verifying a signal seen during a device reference pressure first digit configuration check; [0048] Figure 9C shows a user interface for initiating a device reference pressure second digit configuration check; [0049] Figure 9D shows a user interface for verifying a signal seen during a device reference pressure second digit configuration check; [0050] Figure 9E shows a user interface for initiating a device reference pressure third digit configuration check; [0051] Figure 9F shows a user interface for verifying a signal seen during a device reference pressure third digit configuration check; [0052] Figure 10 shows an example of a sequence of illuminations determined by a tirc pressure monitoring device; [0053] Figure 11 shows matching sequences of illuminations provided by a network of tire pressure monitoring devices; [0054] Figure 12 shows non-matching sequences of illuminations provided by a network of tire pressure monitoring devices; [0055] Figure 13 shows illustrative flashing sequences for LEDs of the tire pressure monitoring devices of Figure 1 to show device location configuration; [0056] Figure 14A shows a user interface for initiating a device location configuration check; [0057] Figure NB shows a user interface for verifying a signal seen during a device location configuration check; [0058] Figure 15 shows a flow diagram of a method according to an example; [0059] Figure 16 shows a first alternative indication to be provided by a tire pressure monitoring device; [0060] Figure 17 shows matching indications in accordance with the indication of Figure 16 provided by the network of tire pressure monitoring devices; [0061] Figure 18 shows non-matching indications in accordance with the indication of Figure 16 provided by the network of tire pressure monitoring devices; [0062] Figure 19 shows a second alternative indication to be provided by a tire pressure monitoring device; [0063] Figure 20 shows matching indications in accordance with the indication of Figure 19 provided by the network of tire pressure monitoring devices [0064] Figure 21 shows non-matching indications in accordance with the indication of Figure 19 provided by the network of tire pressure monitoring devices [0065] Figure 22 shows a further example of matching indications provided by the network of tire pressure monitoring devices; and [0066] Figure 23 shows a further example of non-matching indications provided by the network of tire pressure monitoring devices.

DETAILED DESCRIPTION

[0067] A tire pressure monitoring device 10 according to an example is shown schematically in Figure 1. The tire pressure monitoring device 10 comprises a processor 12, a memory 14, a transceiver 16, a visual indicator or display which is an LED 18 in this example, a sensor 19 and a power source 21.

[0068] The processor 12 may be any suitable processor including single and multi-core processors, an Application Specific Integrated Circuit (ASIC) or like. The processor 12 is communicatively coupled to the transceiver 16, the LED 18, the memory 14 and the power source 21. The processor 12 is configured to generate various cryptographic parameters, as will be discussed hereinafter.

100691 Memory 14 is a flash memory that stores configuration data 20 and also computer readable instructions for execution by the processor 12 in operation, although it will be appreciated that other types of memory may be used. The configuration data 20 can therefore be updated as required with configuration data. A reference tire pressure is stored in the configuration data 20. Additional data can also be stored in the configuration data 20, for example an aircraft identifier (such as an aircraft Tail identifier) and a wheel position.

100701 Transceiver 16 is an appropriate transceiver capable of receiving a request to confirm the configuration data 20. In this example, the transceiver 16 comprises a first short-range radio signal transceiver operating according to the NFC protocol, and a second 17 transceiver operating according to a Bluetooth low energy (BLE) communication protocol. Although described here as operating according to specific protocols, it will be appreciated that other embodiments where the first 15 and second 17 transceivers operate according to different protocols, for example with the second transceiver 17 operating via a WiFi protocol, are also envisaged. When the transceiver 16 receives a request to confirm the configuration data 20, the processor 12 encodes the configuration data 20 stored in the memory 14 of the tire pressure monitoring device 10, and transmits a signal 22 indicative of the configuration data 20 via the LED 18 to a user 24 observing the tire pressure monitoring device 10. Here the LED 18 is a three-colour LED which is capable of displaying red, blue, and green coloured light. Other examples may use a different number of colours of light than three and/or use other colours than red, blue, and green. Still further examples may utilise a display screen, for example an LCD screen, instead of or in addition to the LED 18. In examples herein, the user 24 is a human. As the user 24 can be taken to be a trusted source, and the tire pressure monitoring device 10 is itself a trusted source, an untrusted device 32 can be used to input the user's verification of the configuration data 20, as will be discussed in more detail hereafter. 100711 The transceiver 16 is further able to transmit and receive cryptographic parameters from the tire monitoring device 10 to other tire monitoring devices 202,204,206,208,210, as will be discussed in more detail hereafter.

100721 The tire pressure monitoring device 10 is installed on an aircraft 100 in use, and is one of a network 200 of tire pressure monitoring devices, with the aircraft 100 illustrated schematically in Figure 2, and the network 200 of tire pressure monitoring devices illustrated schematically in Figure 3. As an example, the aircraft 100 has a first group 102 of two nose wheels, and a second group 104 of four main landing gear wheels. Each wheel in the first 102 and second 104 groups of wheels has an associated tire pressure monitoring device, such that there are six tire pressure monitoring devices installed on the aircraft 100.

100731 As illustrated in Figure 3, the tire pressure monitoring device 10 is a first tire pressure monitoring device utilised as left nose tire pressure monitoring device 10, with a second tire pressure monitoring device 202 being a right nose tire pressure monitoring device, a third fire pressure monitoring device 204 being a first main landing gear fire pressure monitoring device, a fourth tire pressure monitoring device 206 being a second main landing gear tire pressure monitoring device, a fifth tire pressure monitoring device 208 being a third main landing gear tire pressure monitoring device, and a sixth tire pressure monitoring device 210 being a fourth main landing gear tire pressure monitoring device. It will be appreciated that each of the second 202 through sixth 210 tire pressure monitoring devices has substantially the same structure and functionality as the first tire pressure monitoring device 10 illustrated in Figure 1. It will further be appreciated that the locations of each tire pressure monitoring device 10,202,204,206,208,210 are illustrative only, and that any of the tire pressure monitoring devices 10,202,204,206,208,210 could be used at any wheel location on an aircraft, if so desired. 100741 When initially installed on the aircraft 100, the tire pressure monitoring devices 10,202,204,206,208,210 are not configured, ie do not store the configuration data 20, and are incapable of direct communication between one another. The user 24 therefore uses the untrusted device 32 to configure the network 200 of tire pressure monitoring devices 10,202,204,206,208,210, as will now be described.

100751 Initially, the user 24 approaches the first ti re pressure monitoring device 10 to begin configuration. The user 24 inputs the desired configuration data 20 for the first tire pressure monitoring device 10, including the wheel location and reference pressure, into the untrusted device 32, and the first tire pressure monitoring device 10 is touched with the untrusted device 32 to establish near field communication using the first transceiver 15. Establishment of near field communication can wake the first tire pressure monitoring device 10 from a sleep mode in which at least some functionality of the first tire pressure monitoring device 10 is inhibited. For example, the second transceiver 17 may be turned off when in the sleep mode. The desired configuration data 20 may also include an aircraft tail ID, or any other appropriate configuration parameter. The near field communication is used to uniquely identify the tire pressure monitoring device 10 to the untrusted device 32, and to wake the first tire pressure monitoring device 10 from the sleep mode. Upon waking from the sleep mode, the second transceiver 17 is activated temporarily. The configuration data 20 is then transferred from the untrusted device 32 to the first tire pressure monitoring device 10 via a Bluetooth ® low energy protocol using the second transceiver 17 as previously described. The configuration data 20 is then stored in the memory 14, with the first tire pressure monitoring device 10 deleting any previously stored configuration data before the newly received configuration data 20 is stored. In other examples the configuration data 20 is transferred from the untrusted device 32 to the first tire pressure monitoring device 10 via near field communication. 100761 Once the configuration data 20 has been stored, the second transceiver remains activated and the processor 12 generates a key pair comprising a public key 212 and a private key 214, along with a random number 216, with use of these parameters described in more detail herein.

100771 This process of loading and transferring configuration data 20 is then repeated for the second through sixth tire pressure monitoring device 202,204,206,208,210.

100781 As will be appreciated from the discussion above, during the process of configuring each tire pressure monitoring device 10,202,204,206,208,210, each tire monitoring device 10,202,204,206,208,210 generates a respective key pair comprising a public key 212a-212f and a private key 214a-214f, along with a random number 216a-216f. This is illustrated schematically in Figure 4, and these cryptographic parameters arc utilised to establish secure communication within the network 200 of tire pressure monitoring devices 10,202,204,206,208,210. The key pair and random number can be generated in any suitable way, in this example, the key pair is generated using any suitable cryptographic pseudo-random generator.

100791 As a first step in establishing secure communication, illustrated schematically in Figure 5, each fire pressure monitoring device 10,202,204,206,208,210 broadcasts, in a respective first message 218a-218f, its public key 212a-212f and its configuration data 20 to each of the other tire pressure monitoring devices 10,202,204,206,208,210. In other words, each tire pressure monitoring device broadcasts the first message to all of the other tire pressure monitoring devices. The untrusted device 32 is used as a router for the first messages 218a-218f, with each tire pressure monitoring device 10,202,204,206,208,210 receiving the other first messages 218a-218f via the untrusted device. Here bold arrows denote sent messages, whilst non-bold arrows denote received messages. The first messages 218a-218f are broadcast and received via the second transceiver 17 of each tire pressure monitoring device 10,202,204,206,208,210, using a BLE protocol. Once all first messages 218a-218f are sent and received, each tire pressure monitoring device 10,202,204,206,208,210 knows the public key 212a-212f and configuration data 20 of each other tire pressure monitoring device 10,202,204,206,208,210. By broadcasting the first messages 218a-218f from the tire pressure monitoring devices 10,202,204,206,208,210, a number of messages sent by each tire pressure monitoring device 10,202,204,206,208,210 may be reduced compared to, for example, an arrangement where each tire pressure monitoring device 10,202,204,206,208,210 unicasts its public key 212a-212f and/or its configuration data 20 to each other tire pressure monitoring device 10,202,204,206,208,210. Through the use of a broadcast message, a single transmitted message from a tire monitoring device may be received by a plurality of other devices, reducing message traffic and saving power. As illustrated in Figure 5, a single transmitted message is received by all of the other tire monitoring devices.

100801 As a second step in establishing secure communication, illustrated schematically in Figure 6, the processor 12 of each tire pressure monitoring device 10,202,204,206,208,210 uses its own random number 216-216f, the public keys 212a-212f both generated and received by the tire pressure monitoring device 10,202,204,206,208,210, and its own configuration data 20, to generate a cryptographic commitment 220a-2201 The cryptographic commitment can be generated in any suitable way, in this example it is generated using a hash-based concurrent non-malleable commitment. Each tire pressure monitoring device 10,202,204,206,208,210 broadcasts, in a second message 222a-222f its respective cryptographic commitment 220a-220f to each of the other tire pressure monitoring devices 10,202,204,206,208,210.

100811 The untrusted device 32 is used as a router for the second messages 222a-222L with each tire pressure monitoring device 10,202,204,206,208,210 receiving the other second messages 222a-222f via the untrusted device 32. Here bold arrows denote sent messages, whilst non-bold arrows denote received messages. The second messages 222a-222f are broadcast and received via the second receiver 17 of each tire pressure monitoring device 10,202,204,206,208,210, using a BLE protocol. Once all second messages 222a-222f are sent and received, each tire pressure monitoring device 10,202,204,206,208,210 knows the cryptographic commitment 220a-220f of each other tire pressure monitoring device 10,202,204,206,208,210. By broadcasting the second messages 222a-222f from the tire pressure monitoring devices 10,202,204.206,208,210, a number of messages sent by each tire pressure monitoring device 10,202,204,206,208,210 may be reduced compared to, for example, an arrangement where each tire pressure monitoring device 10,202,204,206,208,210 unicasts its cryptographic commitment 220a-220f to each other tire pressure monitoring device 10,202,204,206,208,210.

100821 As a third step in establishing secure communication, illustrated schematically in Figure 7, each fire pressure monitoring device 10,202,204,206,208,210 broadcasts, in a respective third message 224a-224L an input 226a-226f to open the respective cryptographic commitment 220a-220f, to each other tire pressure monitoring device 10,202,204,206,208,210. Here bold arrows denote sent messages, whilst non-bold arrows denote received messages. The third messages 224a-224f are broadcast and received via the second receiver 17 of each fire pressure monitoring device 10,202,204,206,208,210, using a BLE protocol. Once all third messages 224a-224f are sent and received, each tire pressure monitoring device 10,202,204,206,208,210 can open and verify the cryptographic commitments 220a-220f received from the other tire pressure monitoring devices 10,202,204,206,208,210. By broadcasting the third messages 224a-224f from the tire pressure monitoring devices 10,202,204,206,208,210, a number of messages sent by each fire pressure monitoring device 10,202,204,206,208,210 may be reduced compared to, for example, an arrangement where each tire pressure monitoring device 10,202,204,206,208,210 unicasts its input 226a-226f to each other tire pressure monitoring device 10,202,204,206,208,210.

100831 Where a cryptographic commitment 220a-220f cannot be verified, the establishment of secure communication is aborted, and an error message is communicated to the untrusted device 32. For example, the error message could be communicated using Bluetooth ® or NFC to the untrusted device 32 for display by the untrusted device 32. Alternatively, or additionally, the error message could be communicated using the LED of the tire pressure monitoring device, such as by lighting the LED continuously red.

100841 Where the cryptographic commitments 220a-220f are all verified, each tire pressure monitoring device 10,202,204,206,208,210 generates, for each other tire pressure monitoring device 10,202,204,206,208,210, a seed for a pseudo-random generator. The generation of the seed comprises utilising a hash function with inputs of the private key 214a-214f of the tire pressure monitoring device 10,202,204,206,208,210 performing the generation, and the public key 212a-212f of the tire pressure monitoring device 10,202,204,206,208,210 for which generation is being performed.

100851 Using the pseudo random generator, each tire pressure monitoring device 10,202,204,206,208,210 generates a shared key pair comprising a first shared key k, and a second shared key k', using any suitable cryptographic pseudo-random generator such as AES in counter mode.

100861 Each tire pressure monitoring device 10,202,204,206,208,210 then generates, for each other tire pressure monitoring device 10,202,204,206,208,210, a value using a pseudo-random function based on the first shared key k, and associated random numbers 216a-216f and the respective public keys 212a-212f of the two tire pressure monitoring devices 10,202,204,206,208,210 in question as inputs to the pseudo-random function. The pseudo-random function may comprise any suitable cryptographic pseudo-random function such as HMAC.

100871 Each tire pressure monitoring device 10,202,204,206,208,210 sends its respective values to the other tire pressure monitoring devices 10,202,204,206,208,210, with each tire pressure monitoring device 10,202,204,206,208,210 checking validity of the received values using the same pseudo-random function based on the first shared key k.

100881 Where a value cannot be verified, the establishment of secure communication is aborted, and an error message is communicated to the untrusted device 32. For example the error message could be communicated using Bluetooth or NFC to the untrusted device 32 for display by the untrusted device 32. Alternatively, or additionally, the error message could be communicated using the LED of the tire pressure monitoring device, such as by lighting the LED continuously red.

100891 Where values are verified, the respective tire pressure monitoring devices 10,202,204,206,208,210 use the respective second shared keys k' for secure future communication. Although the establishment of the secure communication required the use of unencrypted messages between the tire pressure monitoring devices, the untrusted device 32 cannot know the second shared keys k' because generating these requires knowledge of the private keys that are not shared.

10090] In such a manner secure communication can be established between tire pressure monitoring devices 10,202,204,206,208,210 of the network 200, i.e. with secure communication established on a pair-wise basis. The untrusted device does not know the second shared keys k' used for communication, and the numbers of messages required to be exchanged is reduced by the use of broadcast messages. Furthermore, the secure communication does not require a pre-installed key or the like on the tire pressure monitoring devices 10, 202, 204, 206, 208, 210.

100911 Where secure communication has been established, the tire pressure monitoring devices 10,202,204,206,208,210 can be used to communicate to the user that each tire pressure monitoring device 10,202,204,206,208,210 shares the same security code. Here each tire pressure monitoring device 10,202,204,206,208,210 generates a numerical value, representing a security code. The numerical value in some examples comprises a truncated hash of the configuration data 20, public keys 212a-212f and random numbers 216a-216f, such as a truncated hash function with an input of a concatenation of the configuration data 20, public keys 212a-212f and random numbers 216a-216f. Any suitable hash function can be used, such as SHA-3. As each of the tire pressure monitoring devices 10,202,204,206,208,210 knows the same configuration data 20, public keys 212a-212f and random numbers 216a-216f, the truncated hash, and hence the security code, should be the same for each tire pressure monitoring device 10,202,204,206,208,210. This can be utilised to check configuration of the tire pressure monitoring devices 10,202,204,206,208,210, as will be described in more detail hereafter. It will be appreciated that the security codes themselves can be stored by the respective tire pressure monitoring devices 10,202,204,206,208,210, and can be thought of as part of configuration data of that tire pressure monitoring device 10,202,204,206,208,210.

100921 In order to confirm that the correct configuration data is stored by the tire pressure monitoring devices 10,202,204,206,208,210, the tire pressure monitoring devices 10,202,204,206,208,210 can communicate their stored configuration data to the user using the respective LEDs 24, and the user can confirm the configuration data using the untrusted device 32.

10093] One piece of configuration data 20 to be checked is the stored reference pressure of the first tire pressure monitoring device 10. Here, as an example, an AMM task card may provide to the user 24 a list of reference pressures for different tire pressure monitoring device locations, eg nose left, nose right, and so on, along with an associated expected flash sequence for the LED 18 which would correctly indicate the associated tire pressure monitoring device reference pressure. In the case of the first tire pressure monitoring device 10, which is used as the left nose tire pressure monitoring device in the example previously described, an appropriate reference pressure may be 178 PSI. Here separate flash sequences of the LED 18 may be performed for each digit of the reference pressure, ie a first flash sequence/signal 22 for the "hundreds" digit, a second flash sequence/signal 22 for the "tens" digit, and a third flash sequence/signal 22 for the "units" digit. The first flash sequence of the LED 18 in such a case may be one green flash, followed by one blue flash, followed by one red flash. The second flash sequence of the LED 18 in such a case may be one green flash, followed by seven blue flashes, followed by one red flash. The third flash sequence of the LED 18 in such a case may be one green flash, followed by eight blue flashes, followed by one red flash. Illustrative appropriate flash sequences (ie signals 22) for tire pressure monitoring device reference pressure are shown schematically in Figure 8. The green and red flashes of the LED 18 may each have a duration of 1 second. The blue flashes of the LED 18 may occur at a frequency of 1Hz.

100941 When checking the stored reference pressure of the first tire pressure monitoring device 10, the user 24 submits a request for the first tire pressure monitoring device 10 to display the stored reference, via the LED 18, using a user interface of the untrusted device 32. The untrusted device 32 does not tell the first tire pressure monitoring device 10 which sequence to flash, but rather provides an instruction for the first tire pressure monitoring device 10 to flash its sequence indicative of the stored reference pressure. An exemplary user interface 60 for starting the check for the "hundreds" digit is shown in Figure 9A, with the user 24 interacting with user interface element 62 to start the check for the "hundreds" digit. An exemplary user interface 64 for a user 24 to verify the signal 22 for the "hundreds" digit is shown in Figure 9B, with the user 24 interacting with user interface elements 66,68 to indicate whether the signal 22 is verified or not.

100951 Similarly an exemplary user interface 70 for starting the check for the "tens" digit is shown in Figure 9C, with the user 24 interacting with user interface element 72 to start the check for the "tens" digit. An exemplary user interface 74 for a user 24 to verify the signal 22 for the "tens" digit is shown in Figure 9D, with the user 24 interacting with user interface elements 76,78 to indicate whether the signal 22 is verified or not. An exemplary user interface 80 for starting the check for the "units" digit is shown in Figure 9E, with the user 24 interacting with user interface element 82 to start the check for the "units" digit. An exemplary user interface 84 for a user to verify the signal 22 for the "units" digit is shown in Figure 9F, with the user 24 interacting with user interface elements 86,88 to indicate whether the signal 22 is verified or not.

100961 Once the desired configuration data 20 has been verified for the first tire pressure monitoring device 10, the user can move to the next tire pressure monitoring device 202,204,206,208,210 and perform the same steps to ensure configuration of each of the tire pressure monitoring devices 10,202,204,206,208,210.

100971 It has been found that it may not be necessary to check the reference pressure for each tire pressure monitoring device 10,202,204,206,208,210, and that, instead, it may be sufficient to check the reference pressure for only one tire pressure monitoring device per wheel group, i.e. one tire pressure monitoring device within the first group 102 and one tire pressure monitoring device within the second group 104.

100981 In particular, given that the tire pressure monitoring devices 10,202,204,206,208,210 check the stored reference pressures amongst themselves during a tire pressure check, it may be considered sufficient that a subset of fewer than all, and more particularly a single one, of the tire pressure monitoring devices 10,202,204,206,208,210 of each respective first set 212 and second set 214, is checked for the stored reference pressure during configuration of the tire pressure monitoring devices 10,202,204,206,208,210. This may reduce a time taken to configure the tire pressure monitoring device 10,202,204,206,208,210, and may reduce a burden on the user 24.

100991 Another piece of configuration data to be checked is the security codes mentioned above. To facilitate checking of the security codes, each tire pressure monitoring device 10,202,204,206,208,210 determines a sequence of illuminations to be provided using the respective LED 18, with the sequence of illuminations based on the security code stored by the respective tire pressure monitoring device 10,202,204,206,208,210.

101001 An exemplary sequence 300 of illuminations is shown in Figure 10. The sequence 300 comprises a first 302 green illumination of the LED 18, a second 304 blue illumination of the LED 18, a third 306 blue illumination of the LED 18, a fourth 308 non-illumination of the LED 18, and a fifth 310 red illumination of the LED 18. It will be appreciated that alternative sequences of illuminations are envisaged, both with different numbers of illuminations and different colours of illuminations. For example, the number and/or colour of illuminations can depend on the security code in question. In some examples, a sequence of 20 illuminations is envisaged, for example illuminations at a frequency of 1Hz for a sequence length of 20s. In some examples, a sequence of 20 illuminations is envisaged at a frequency of 2Hz for a sequence length of 10s.

[0101] The length of time of each illumination and each non-illumination in the sequence of Figure 10 is fixed. A length of time of each illumination, and of each non-illumination, within the sequence can be chosen based on factors such as ease of visibility for the user, and an overall length of the sequence to minimise the amount of time required to check the security codes. In some examples, the length of time of the illumination of the respective light source is at least 0.5 seconds, at least 1 second, at least 2 seconds, or at least 5 seconds. In some examples, the sequence has a length of no more than 60 seconds, for example no more than 50 seconds, no more than 40 seconds, or no more than 30 seconds. In some examples, the sequence has a length of no less than 10 seconds, for example no less than 20 seconds, or no less than 30 seconds.

101021 When it is desired to check the security codes of the tire pressure monitoring device 10,202,204,206,208,210, the user 24 submits a request for the tire pressure monitoring device 10,202,204,206,208,210 to provide the indications they have determined, via the respective LEDs 18, using a user interface of the untrusted device 32. The untrusted device 32 does not tell the tire pressure monitoring devices 10,202,204,206,208,210 which sequence to flash, but rather provides an instruction for the tire pressure monitoring devices 10,202,204,206,208,210 to flash its sequence. The user interface may be similar to the exemplary user interface 60 of Figure 9A. In some examples, the request must be provided within a pre-determined time period of the tire pressure monitoring devices 10,202,204,206,208,210 being woken from the sleep mode for the request to be deemed valid. In some examples the pre-determined time period may be at least 5 minutes, at least 10 minutes, or at least 15 minutes. The request can be transmitted to the tire pressure monitoring devices 10,202,204,206,208,210 via the respective second transceivers 17.

10103] In some examples the request comprises a synchronisation signal configured to initialise synchronisation of provision of the respective indications by the tire pressure monitoring devices 10,202,204,206,208,210. The synchronisation signal can be configured to set, for each of the tire pressure monitoring devices 10,202,204,206,208,210, a start time for provision of the indications. An example of synchronising tire pressure monitoring devices is disclosed in UK patent application no. GB2205505.7, the contents of which are incorporated herein by reference.

10104] At the relevant start time, the LED 18 of each tire pressure monitoring device 10,202,204,206,208,210 is utilised to provide the sequence of illuminations that has been determined by that tire pressure monitoring device 10,202,204,206,208,210. The user 24 examines the sequences of illuminations, and over a period of time the user can confirm whether the LEDs are providing the same sequence of illuminations. Once the user has made their determination, a user interface of the untrusted device 32 can be utilised to send a stop command to the tire pressure monitoring devices 10,202,204,206,208,210, with the stop command causing the tire pressure monitoring devices 10,202,204,206,208,210 to cease provision of the indications. In some examples, the user interface of the untrusted device 32 does not allow the user 24 to send the stop command until a predetermined period has passed since the start time. Such a delay may allow for sufficient time for the user to view the full sequence, and may allow for the full sequence to be viewed more than once such that the user 24 can be certain of the sequences viewed. 10105] When the user 24 determines that each indication provided is the same, with the same colour illumination provided simultaneously, it can be inferred that the configuration data 20 and security code for each tire pressure monitoring device 10,202,204,206,208,210 is the same, and hence that set-up of the secure communication between the tire pressure monitoring devices 10,202,204,206,208,210 has occurred correctly. An example of matching sequences is shown in Figure 11, where each LED provides a matching sequence of illuminations having a same colour at the same time period. The user 24 can confirm that the sequences match using a user interface of the untrusted device 32.

101061 When the user 24 determines that any one of the indications does not match any one of the other indications, for example with different colour illuminations provided simultaneously by different ones of the tire pressure monitoring devices 10,202,204,206,208,210, it can be inferred that the configuration data 20 and/or security code for those tire pressure monitoring devices 10,202,204,206,208,210 is not the same, and hence that set-up of the secure communication between the tire pressure monitoring devices 10,202,204,206,208,210 has occurred incorrectly. An example where the sequences do not match is shown in Figure 12, where one LED provides a sequence of illuminations that does not match the other sequences of illuminations.

101071 The user 24 can confirm whether the sequences match using a user interface of the untrusted device 32. Such a user interface can be similar to the user interface of Figure 9B.

[01081 When the user 24 confirms that the sequences do not match, the user 24 can be directed, using the untrusted device 32, to reconfigure the network 200 of the tire pressure monitoring devices 10,202,204,206,208,210. In some examples, the untrusted device 32 can, in response to the user 24 confirming that the sequences do not match, direct the user 24 to the AMM to determine appropriate remedial action.

101091 When the user 24 confirms that the sequences do match, the untrusted device can prompt the user 24 to move on to checking that the tire pressure monitoring devices 10,202,204,206,208,210 are installed in the correct positions on the aircraft 100.

101101 As an example, an AMM task card may provide to the user a list of tire pressure monitoring device locations, eg nose left, nose right, and so on, along with an associated expected flash sequence for the LED 18 which would correctly indicate the associated tire pressure monitoring device location. In the case of the first tire pressure monitoring device 10, which is used as the left nose tire pressure monitoring device in the example previously described, an appropriate flash sequence of the LED 18 may be one green flash, followed by five blue flashes, followed by one red flash. Illustrative appropriate flash sequences (ie signals 22) for tire pressure monitoring device location are shown schematically in Figure 13. The greed and red flashes of the LED 18 may each have a duration of 1 second. The blue flashes of the LED 18 may occur at a frequency of 1Hz. 101111 When checking the stored location of the first tire pressure monitoring device 10, the user 24 submits a request for the first tire pressure monitoring device 10 to display the stored location, via the LED 18, using a user interface of the untrusted device 32. The untrusted device 32 does not tell the first tire pressure monitoring device 10 which sequence to flash, but rather provides an instruction for the first tire pressure monitoring device 10 to flash its sequence indicative of the stored location. An exemplary user interface 50 for starting the check is shown in Figure 14A, with the user interacting with user interface element 52 to start the check. An exemplary user interface 54 for a user 24 to verify the signal 22 is shown in Figure 14B, with the user 24 interacting with user interface elements 56,58 to indicate whether the signal 22 is verified or not. If the signal 22, here indicative of stored location of the first tire pressure monitoring device 10, is not verified, then the configuration data 20 needs to be reloaded, with the process described above repeated. In other examples, if the signal 22, here indicative of stored location of the first tire pressure monitoring device 10, is not verified, the request and subsequent flash sequence is repeated, or the first tire pressure monitoring device 10, the untrusted device 32, or an application running on the untrusted device 32, is replaced.

101121 As the user 24 can be taken to be a trusted source, and the first tire pressure monitoring device 10 is itself a trusted source, the untrusted device 32 can be used to input the user's verification of the configuration data 20. The verification can be trusted because it occurs between the user 24 (who is trusted) and tire pressure monitoring device 10 (which is trusted because of its certification to a particular DAL).

101131 Once appropriate configuration data has been checked, the tire pressure monitoring devices 10,202,204,206,208,210 can be utilised to perform a tire pressure check to ensure proper functioning of the tire pressure monitoring devices 10,202,204,206,208,210.

101141 As can be seen, verification of the security codes stored by the tire pressure monitoring devices 10,202,204,206,208,210 takes place in a different manner to verification of the stored reference pressures and the wheel locations. By requiring a user to simply confirm that synchronised sequences of illuminations provided by the tire pressure monitoring devices 10,202,204,206,208,210 match, as opposed to providing illuminations that encode a number corresponding to the security code stored by each tire monitoring device, a number of flashes required to be provided to check the security codes may be reduced and an amount of time to check the security codes may be reduced. This may reduce an amount of time taken to configure the network 100 of tire pressure monitoring devices 10,202,204,206,208,210.

[01151 A method 400 in accordance with the above is illustrated in the flow diagram of Figure 15. The method 400 comprises determining 402, at each of a plurality of tire monitoring devices, an indication to be provided by an indicator of the tire monitoring device, the indication based on configuration data stored by the tire monitoring device. The method 400 comprises providing 404 synchronously, at each of the plurality of tire monitoring devices, the respective indication using the indicator of the tire monitoring device. The method 400 comprises, when the indications provided by each of the plurality of tire monitoring devices are the same, confirming 406 that the configuration data stored in each of the plurality of tire monitoring devices is the same.

101161 It will be appreciated that each of the tire pressure monitoring devices 10,202,204,206,208,210 may not be visible at the same time when the tire pressure monitoring devices 10,202,204,206,208,210 are installed on the aircraft 100. Accordingly, the user 24 may check the security codes stored by the tire pressure monitoring devices 10,202,204,206,208,210 in subsets. For example, the user 24 may check tire pressure monitoring devices at the left side of the aircraft 100 separately to checking tire pressure monitoring devices at the right side of the aircraft 100, as tire pressure monitoring devices at the left side of the aircraft 100 may be visible at the same time as one another, with the same applicable for pressure monitoring devices at the right side of the aircraft 100. It will be appreciated that such subsets of the tire pressure monitoring devices 10,202,204,206,208,210 may each be considered a plurality of tire monitoring devices as disclosed herein.

101171 It will also be appreciated that whilst the comparison of synchronous indications provided by the LEDs 18 of the tire pressure monitoring devices 10,202,204,206,208,210 is described above in relation to checking of the security codes, such a comparison can also be utilised to check whether other configuration data stored in the tire pressure monitoring devices 10,202,204,206,208,210 matches. For example, the comparison of synchronous indications provided by the LEDs 18 of the tire pressure monitoring devices 10,202,204,206,208,210 can also be utilised to check whether reference pressures stored between any two or more of the tire pressure monitoring devices 10,202,204,206,208,210 match one another.

101181 Whilst described above in relation to configuring the tire pressure monitoring devices 10,202,204,206,208,210 while the tire pressure monitoring devices 10,202,204,206,208,210 are installed on the aircraft 100, comparison of synchronous indications provided by the LEDs 18 of the tire pressure monitoring devices 10,202,204,206,208,210 can also be utilised to check configuration data stored by the fire pressure monitoring devices 10,202,204,206,208,210 when the tire pressure monitoring devices 10,202,204,206,208,210 are not installed on the aircraft 100.

101191 In some examples the tire pressure monitoring devices 10,202,204,206,208,210 can be loaded with configuration data, and respective cryptographic parameters can be generated and exchanged, when the tire pressure monitoring devices 10,202,204,206,208,210 are not installed on the aircraft. In such examples, the tire pressure monitoring devices 10,202,204,206,208,210 can all be located within sight of the user 24, which may facilitate checking of the respective indications.

101201 In some examples, it may be necessary to replace one or more of the fire pressure monitoring devices 10,202,204,206,208,210 when the tire pressure monitoring devices 10,202,204,206,208,210 have been installed on the aircraft 100. In such examples, the replacement tire pressure monitoring device can be loaded with configuration data prior to installation of the replacement tire pressure monitoring device on the aircraft 100, and the user 24 can walk around the aircraft and compare indications provided by the replacement tire pressure monitoring device to those provided by the already installed tire pressure monitoring devices in turn.

101211 Other forms of indication that enable a comparison of synchronous indications provided by the LEDs 18 of the tire pressure monitoring devices 10,202,204,206,208,210 to check configuration data stored by the tire pressure monitoring devices 10,202,204,206,208,210 are also envisaged.

101221 A first alternative indication 500 is illustrated in Figure 16, and again takes the form of a sequence of illuminations. In the sequence of Figure 16, illuminations of an LED 18 can have different periods, but with each period being a multiple of a base time period, such as 5 seconds. Here, a first illumination 502 is a green illumination of length seconds (two base periods). A second 504 period of non-illumination has a length of 5 seconds (one base period). A third 506 illumination is a blue illumination of length five seconds (one base period). A fourth 508 illumination is a red illumination of length 15 seconds (three base periods).

101231 Similar to what has already been described herein in relation to the sequence of Figure 10, when using the form of the first alternative indication 500 the tire pressure monitoring devices 10,202,204,206,208,210 provide indications synchronously. A scenario where indications provided by each tire pressure monitoring device 10,202,204,206,208,210 match is shown in Figure 17, whilst a scenario where one of the indications provided does not match the remainder of the indications provided is shown in Figure 18. Where all indications match, the state of illumination, for example colour and/or non-illumination, and the length of time of each indication match. Where one indication does not match the remainder of the indications, the non-matching indication has a same sequence of coloured illuminations/non-illuminations, but the time periods for non-illumination and providing a blue illumination vary compared to the other illuminations.

[01241 A second alternative indication 600 is shown in Figure 19, and again takes the form of a sequence of illuminations. In the sequence of Figure 19, the sequence begins with a green illumination 602 of fixed length, and ends with a red illumination 604 of fixed length. A blue illumination 606 is provided between the green 602 and red 604 illuminations, with the length of the blue illumination 606 dependent on the security code stored by the respective tire pressure monitoring device 10,202,204,206,208,210. Where each tire pressure monitoring device 10,202,204,206,208,210 is visible to the user 24, the user 24 should be able to establish, without aid, whether the blue illuminations 606 provided by tire pressure monitoring device 10,202,204,206,208,210 match. Where each tire pressure monitoring device 10,202,204,206,208,210 is not visible to the user 24, for example where the tire pressure monitoring devices 10,202,204,206,208,210 are installed on the aircraft 100, the user 24 can establish, with a timer or the like, a length of each blue illumination 606 provided by tire pressure monitoring devices 10,202,204,206,208,210. The user 24 can then determine whether the indications provided by the tire pressure monitoring devices 10,202,204,206,208,210.

101251 A matching set of indications is shown in Figure 20, whilst a non-matching set of indications is shown in Figure 21. In the set of matching indications, the length of the blue illuminations 606 is the same. In the set of non-matching indications, one of the blue illuminations 606 has a period less than the period of the remaining blue illuminations 606.

101261 In another example, the indication determined by each tire pressure monitoring device 10,202,204,206,208,210 can comprise a period of illumination of that tire pressure monitoring device 10,202,204,206,208,210, and periods of non-illumination corresponding to periods when each other tire pressure monitoring device 10,202,204,206,208,210 is intended to be illuminated. In such a manner, only one tire pressure monitoring device 10,202,204,206,208,210 should be illuminated at a given time.

101271 Examples of such indications can be seen in Figures 22 and 23. In Figure 22, each indication starts with a green illumination 702 of fixed length, and ends with a red illumination 704 of fixed length. These start and end indications occur simultaneously at all the tire pressure monitoring devices. A blue illumination 706 is provided between the green 702 and red 704 illuminations along with a number of periods 708 of non-illumination. The lengths of the blue illuminations 706 and the periods 708 of non-illumination are unimportant, however, as seen in Figure 22, no two blue illuminations 706 are provided at the same time, and at no time are all LEDs 18 undergoing a period of non-illumination. In such a manner, the indications provided by the tire pressure monitoring devices 10,202,204,206,208,210 can be considered to be the same, with each tire pressure monitoring device 10,202,204,206,208,210 having correctly determined when each tire pressure monitoring device 10,202,204,206,208,210 is illuminated and not illuminated.

101281 In contrast, in Figure 23 it can be seen that two tire pressure monitoring devices arc providing blue indications 706 at the same time. In this context, the indications provided by those tire pressure monitoring devices are not considered to be the same, and it can be inferred that the security codes of those tire pressure monitoring devices do not match.

101291 In each example discussed herein, each tire pressure monitoring device 10,202,204,206,208,210 determines an indication to be provided based on configuration data, in the form of security codes, stored by that tire pressure monitoring device 10,202,204,206,208,210. The tire pressure monitoring devices 10,202,204,206,208,210 then provide, synchronously using their respective LEDs, the indications they have determined. When the indications are the same, the tire pressure monitoring devices 10,202,204,206,208,210 have the same security codes. When the indications are not the same, the tire pressure monitoring devices 10,202,204,206,208,210 do not all have the same security code, and reconfiguration of the tire pressure monitoring devices 10,202,204,206,208,210 may be required.

[0130] As noted above, by requiring a user to simply confirm that synchronised sequences of illuminations provided by the tire pressure monitoring devices 10,202,204,206,208,210 match, as opposed to providing illuminations that encode a number corresponding to the security code stored by each tire monitoring device, a number of flashes required to be provided to check the security codes may be reduced and an amount of time to check the security codes may be reduced. This may reduce an amount of time taken to configure the network 100 of tire pressure monitoring devices 10,202,204,206,208,210.

[0131] It is to noted that the term o as used herein is to be interpreted to mean "and/or", unless expressly stated otherwise.

Claims (25)

1. CLAIMS: 1. A method of confirming configuration data stored in a plurality of fire monitoring devices, the method comprising: determining, at each of the plurality of tire monitoring devices, an indication to be provided by an indicator of the tire monitoring device, the indication based on configuration data stored by the tire monitoring device; providing synchronously, at each of the plurality of tire monitoring devices, the respective indication using the indicator of the tire monitoring device; and when the indications provided by each of the plurality of tire monitoring devices are the same, confirming that the configuration data stored in each of the plurality of tire monitoring devices is the same.
2. 2. The method according to Claim 1, wherein the method comprises, when the indications provided by the plurality of tire monitoring devices are not the same, determining that the configuration data stored in each of the plurality of tire monitoring devices is not the same.
3. 3. The method according to Claim 1 or Claim 2, wherein the indications comprise visual indications, and the indicators comprise visual indicators.
4. 4. The method according to Claim 3, wherein the visual indicators comprise light sources, and the method comprises selectively illuminating the light sources to provide the indications.
5. 5. The method according to Claim 4, wherein determining the indication to be provided comprises determining a length of time of an illumination of the respective light source.
6. 6. The method according to Claim 5, wherein the length of time of the illumination of the respective light source is at least 0.5 seconds, at least 1 second, at least 2 seconds, or at least 5 seconds.
7. 7. The method according to any one of Claims 4 to 6, wherein determining the indication to be provided comprises determining a colour of an illumination of the respective light source.
8. 8. The method according to any one or Claims 4 to 7, wherein determining the indication to be provided comprises determining a sequence of illuminations of the respective light source.
9. 9. The method according to Claim 8, wherein the sequence of illuminations of the respective light source comprises illuminations having a time of illumination that is a multiple of a base value time of illumination.
10. 10. The method according to Claim 8 or Claim 9, wherein the sequence of illuminations of the respective light source comprises a repeating sequence of illuminations of the light source.
11. 11. The method according to any one of Claims 8 to 10, wherein the sequence has a length of no more than 60 seconds.
12. 12. The method according to any one of Claims 8 to 11, wherein the sequence has a length of no less than 10 seconds.
13. 13. The method according to any one of Claims 4 to 12, wherein, for each tire monitoring device of the plurality of tire monitoring devices, the indication comprises a period of illumination of the light source of the tire monitoring device, and a period in which the light source is turned off during illumination of each of the light sources of the other tire monitoring devices of the plurality of tire monitoring devices.
14. 14. The method according to any one of the preceding claims, wherein the method comprises providing the respective indications in response to receipt of a request to check the configuration data at the plurality of tire monitoring devices.
15. 15. The method according to Claim 14, wherein the method comprises waking each of the plurality of tire monitoring devices from a sleep mode, and providing the indication at the respective tire monitoring device where the request to check the configuration data is received within a pre-determined time period from the tire monitoring device being woken from the sleep mode.
16. 16. The method according to any one of the preceding claims, wherein the method comprises stopping providing the respective indication in response to receipt of a request to stop providing the respective indication at the plurality of tire monitoring devices.
17. 17. The method according to any one of the preceding claims, wherein confirming that the configuration data stored in each tire monitoring device of the plurality of tire monitoring devices is the same takes place by an operator using an untrusted device.
18. 18. The method according to any one of the preceding claims, where the configuration data comprises at least one of a reference pressure of a tire of wheel to which the tire monitoring device is to be affixed in use; an on-aircraft wheel position of the respective tire monitoring device; an aircraft identifier; and a cryptographic parameter associated with at least one of the respective tire monitoring device and the set of tire monitoring devices.
19. 19. The method according to any one of the preceding claims, wherein determining the indication to be provided by the indicator of the tire monitoring device comprises utilising a hash of the configuration data.
20. 20. The method according to any one of the preceding claims, wherein the method is performed when the plurality of tire monitoring devices are not installed on an aircraft.
21. 21. The method according to any one of the preceding claims, wherein the method is performed when the plurality of tire monitoring devices are installed on an aircraft.
22. 22. The method according to any one of the preceding claims, wherein the configuration data is first configuration data and comprises a cryptographic parameter, the method further comprising: transmitting, from a subset of fewer than all of the plurality of tire pressure monitoring devices, a configuration data signal which encodes respective second configuration data, wherein the second configuration data comprises a reference pressure of a tire of a wheel to which the respective tire monitoring device is to be affixed in use.
23. 23. A set of tire monitoring devices, each of the set of tire monitoring devices configured to: determine, based on configuration data stored by the tire monitoring device, an indication to be provided by an indicator of the tire monitoring device; and provide, synchronously, at each of the set of tire monitoring device, the respective indication using the indicator of the tire monitoring device.
24. 24. A tire monitoring device for use in the set of tire monitoring devices of Claim 23.
25. 25. An aircraft comprising at least one of a set of tire monitoring devices as claimed in Claim 23, and a tire monitoring device as claimed in Claim 24.