TMC is an independent, primarily volunteer organization that relies on ad revenue to cover its operating costs. Please consider whitelisting TMC on your ad blocker or making a Paypal contribution here: paypal.me/SupportTMC

Let the hacking begin... (Model S parts on the bench)

Discussion in 'Model S' started by wk057, Dec 14, 2015.

  1. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    #1 wk057, Dec 14, 2015
    Last edited by a moderator: Mar 13, 2016
    Greetings!

    You folks all pretty much know me and my mountain of projects by now. Well, I've added one more to that ever growing list.

    Behold! A Model S 17" MCU and IC running on the bench. :)

    2015-12-14%2002.40.05-crop.jpg

    And a short video of the minor success and tinkering I've done getting these guys running on the bench:

    Tesla Model S Hacking - Running the MCU and IC on the Bench - YouTube


    Nothing too exciting just yet, but this is step one for sure.

    I sent the video and some pics to a friend earlier and his response was: "I think you might want to go in for service. The car appears to be missing." lol

    At this time I've gotten a few things accomplished:


    • Figured out the power and ground wires that run the 17", IC, and built in audio amp.
    • Figured out the connections between the IC and the MCU.
      • There is a CAN pair, an ethernet connection (via that 4-pin connector), and a wake-up signal line
    • Wired up a speaker to the center channel.
      • The alert noise the car makes can be heard. Music plays via bluetooth. No radio since I don't have the radio module.
      • This is a premium audio MCU and actually has line-level outputs for the audio channels as well as amplified outputs... not sure the purpose of the latter in the premium audio setup.
    • Figured out how to "press the brake pedal" (or at least tell the IC that's what happened)

    So far it's a short list, but I plan on expanding it greatly. Since I have this unit on the bench from a salvage vehicle I have no warranty fears and basically nothing to prevent me from tinkering. If I break it... oh well, I'm not down a vehicle.

    Some goals:


    • Figure out the rear view camera stuff
      • An awesome but pretty unobtrusive hack would be to be able to display whatever we want in the Camera "app".
      • I'm envisioning an HDMI aux input port...
    • Gain access to the system software
      • It's been done, and this unit is on 6.1 still. So, should be possible but I'm not sure. I'm pretty capable. If there is a way in, I'll find it.
      • From here, any number of things is possible, and that list is pretty long.
    • Hardware mod to take over the display
      • A mod to the IC and/or the MCU could potentially allow utilization of the screens by a secondary processor. This could make it so a custom piece of hardware could overlay data on the screens, intercept touch commands if desired, etc, so that the interface can be modified in all sorts of cool ways. The best part about this would be that the hack wouldn't require breaking into the software running on the units, and thus wouldn't mess up any existing functionality or any warranty related things aside from the MCU/IC modifications.
    • Find a way to gather and decode technical data about the vehicle
      • I have tons of CAN logs from working Model S vehicles. Using my bench setup I could potentially start safely decoding what these commands mean.
        • For example, I can playback some of the log to the bench setup and see if there is any result. Like, let's say I have a hunch that a certain packet is telling the battery SoC. Well, I can play that to the bench CAN bus and see if if updates the SoC display.
    • Hack enough to potentially use these units in an EV conversion project
      • Probably ambitious... but have you seen my other projects? ;)

    Lot's to be done. One of the things I'll need to be able to do is convince this setup to "start" the car. Currently it won't "start" when I "press" the brake pedal since there are a lot of things it can't communicate with. I'm hoping that I can fake it out by playing back portions of CAN logs from actual vehicles and maybe eventually get the IC to the "on" screen. Keep in mind that literally the only things I have hooked up currently are the MCU and IC. No other modules that would sit on the CAN buses. So everything it is displaying about the car (battery SoC, mileage, door positions, etc) is saved and displayed since it is the last thing it saw while it was connected and powered in the actual salvage vehicle.

    Essentially one of my main goals with this is to find a way to add functionality to the units one way or another that can be utilized in a working car without causing any major concerns. Additionally I want to get a better understanding of everything that the car does (specifically on the CAN bus and the ethernet connections) to potentially be able to use that info for non-Tesla based diagnostic info and such. For example, I would really love to know what my pack voltage was at any given time, or the numeric power usage value.

    Should be fun, and I welcome any insight anyone might have into how to go about some of the goals I've got planned, or otherwise. Additionally, if anyone is really interested in tinkering and is able to get here physically with whatever they'd want to use to tinker, I'm all for that. I really want this car to be less of a black box than it is today.
     
  2. AGM

    AGM Member

    Joined:
    Apr 16, 2014
    Messages:
    21
    Location:
    El Dorado Hills, CA, United States
    make it so.
     
  3. msnow

    msnow Active Member

    Joined:
    Jul 14, 2015
    Messages:
    2,774
    Location:
    SoCal
    That looks like a bunch of fun. Goals are exactly what I'd do except I'd prioritize the software. Curious if it's 2 factor authentication. It looks like you are connected to your network in the video?? I wonder if it can be accessed remotely.
     
  4. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    I haven't let the unit connect via the cell network or wifi. I only have it connected to my phone via bluetooth for tinkering with the audio outputs. I actually don't think I'm going to let it connect out to the internet at all.

    As for the software, that's probably the most difficult part, so, probably working on that as time allows.
     
  5. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    Success! Got the MCU to "start" the car. :p

    IC now shows the speedo... and now there are 10 errors. lol.

    Pics in a minute
     
  6. SabrToothSqrl

    SabrToothSqrl Active Member

    Joined:
    Dec 5, 2014
    Messages:
    1,364
    Location:
    PA
  7. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
  8. ScepticMatt

    ScepticMatt Member

    Joined:
    Nov 5, 2014
    Messages:
    453
    Location:
    Austria
    "Car needs service", ha
     
  9. Wander

    Wander Member

    Joined:
    Mar 28, 2015
    Messages:
    13
    Location:
    Gelderland
    Cool!

    I would love to see more pictures from the back and inside of these things :)

    They also seem to be running at 3.16 amps at 13.7 volts, if I got that correctly from your video. That's about 43 watts, quite a bit for a car dashboard! I'm quite curious to see which of the two draws the majority of the power (probably that one with the 17" screen) and how much power they use when they are "off"
     
  10. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    Yeah, working on that.

    They are pretty power hungry. Fortunately low enough for my little cheap bench power supplies. Running at a total of 3.7A @ 13.8V right now, so 51W. That's with display brightness 50%. If I crank it to 100% it jumps up by 0.8A or 11W to ~62W! 0% brightness drops it to just under 3A total, or ~42W. So literally 20W difference between 0% and 100% brightness, which is kind of crazy. Means on a 4 hour drive, 0% vs 100% is the difference of about 1/4 mile of range. lol.

    Also, keep in mind I don't have the GSM antenna connected, so it's likely using a little juice to try and contact AT&T towers as well.
     
  11. Wander

    Wander Member

    Joined:
    Mar 28, 2015
    Messages:
    13
    Location:
    Gelderland
    My guess would be that they don't make actually make different versions of the 17" unit for premium/non-premium sound versions. The premium sound version probably just has an amplifier hooked up to the line-level outputs and more and different speakers.

    How many line-level outputs are there?
     
  12. jeffro01

    jeffro01 Member

    Joined:
    Jan 30, 2013
    Messages:
    957
    Location:
    SF Bay Area
    Funny it thinks the passenger door is shut... LOL :)

    Jeff
     
  13. msnow

    msnow Active Member

    Joined:
    Jul 14, 2015
    Messages:
    2,774
    Location:
    SoCal
    I was assuming that stuff was all part of the last known data before it disconnected.
     
  14. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    There are (edit, correction) five line level outputs that I've found and seven amplified outputs. The unit part number says it's a premium audio version. It is pretty likely they're mostly the same though.

    It definitely seems to have the last known state of everything cached.

    Here is a composite of all of the errors I have now for laughs:

    2015-12-14%2014.26.47-composite.jpg

    It *really* wants me to contact Tesla service.... lol
     
  15. int32_t

    int32_t Tesla Spotter

    Joined:
    Nov 21, 2015
    Messages:
    360
    Location:
    Edmonton, AB, Canada
    #15 int32_t, Dec 14, 2015
    Last edited: Dec 14, 2015
    That is so cool! Wish I could drop by ... but I live far, far way :rolleyes:
    Where did you get these treasures?

    How much power do the IC and MCU draw?
    Edit: Looks like somebody asked before me!

    I would like to know if the logs show battery balancing information. Could you add that to your list? :smile:
     
  16. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    Latest comment from my witty friend: "hmm, 'car may be free rolling'. that explains why its missing" hahaha

    Got them from a salvage S that was being parted out.

    IC and MCU are drawing between 42 and 62W when on. I don't really have a way to make them sleep yet to check low power levels. Working on that.

    And pulling logs is on my software hacks list, but that list is a mile long. :)
     
  17. ElektroPionir

    ElektroPionir Member

    Joined:
    Jun 18, 2013
    Messages:
    19
    Location:
    Serbia
    Just remembered that Otmar guy and his stretchla. I hope your new project helps him too...
    Awesome job btw.
     
  18. andrewket

    andrewket 2014 S P85DL, 2016 X P100DL

    Joined:
    Dec 20, 2012
    Messages:
    4,809
    Ah, hours of entertainment. I need to go make some popcorn.

    The line level outputs for the audio is interesting.

    The IC is reporting the pack has 6 miles of range. I'm guessing that was the SOC of the pack that used to be connected? Cached data?
     
  19. wk057

    wk057 Senior Tinkerer

    Joined:
    Feb 23, 2014
    Messages:
    4,660
    Location:
    Hickory, NC, USA
    Yeah, there is an external amplifier (somewhere to the left of the steering column IIRC) that the line level outputs feed with the premium audio package.

    Lots of stuff seems cached, like SoC, mileage, door positions, nav position.

    But now that I I have the thing "started" I'm going to try and play some CAN data to it and figure out one of my big CAN decoding mysteries: Power usage. If I can get the little orange bar to move that'll be awesome. :)

    - - - Updated - - -

    Managed to get it up to throwing 11 errors when I cut off the accessory 12V rail while things were running. That's got to be some kind of record...
     
  20. llavalle

    llavalle Member

    Joined:
    Sep 9, 2013
    Messages:
    541
    Location:
    Somewhere around Montreal in Quebec, Canada
    Check this link : Premium Audio System for Tesla Model S by Light Harmonic - Page 5

    When you have premium audio, the amp actually drives the front doors, the rear lift gate speakers and the sub. The rest of the audio is driven by the MCU's amp.
     

Share This Page