Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Let the hacking begin... (Model S parts on the bench)

This site may earn commission on affiliate links.
Say that to a Gen 1 or Gen 2 Prius owner. You'll get a big laugh.

Ugh. I DO NOT miss that. Mine would take 8 gallons. You could finesse it up to 9 1/2 sometimes, but there were better than even odds it would vomit a cup or two of gasoline all over the place while expelling a pressurized air bubble. That little feature caused hundreds of thousands of times more "evaporative emissions" than it would have saved if it had worked properly.
 
Ok, tell me again why NC is so far* away from Montreal? I'd really like to see that in person!


*Just checked and looks like it would take me just over 17h to get there (EVTripPlanner), not too bad.... and free :D

Come on down! :D

Well, been investigating some stuff with my car's dev mode a little. Found something I found pretty interesting.

So, I set the cruise at 55 MPH on a road. With range mode OFF the car is not using the front motor at all. The front motor is sleeping. If I flip to range mode, the front motor takes over and the rear motor sleeps. Like, pretty much instantly and is imperceptible. In range mode the rear motor barely comes alive even during full regen where I saw the front motor alone putting out 72kW at one point today. During initial acceleration, unless it's very light, the rear motor will kick in for a short bit then go back to sleep. But in range mode ON the majority of the time it appears just the front motor is used and in range mode OFF the rear motor is mostly used. Kinda cool, and weird I guess.

Good to know in any case.

Also, engaging max battery power changes the battery pack heating target to 48C. It also bumps the passive and active cooling targets to 50C and 52C from 30C and 50C respectively. That's pretty crazy. Definitely not going to use this feature for much of anything. Definitely would not suggest it for pre-heating the pack like some have suggested. Additionally, if range mode is on the car will not actively heat the pack even in max battery mode.

Got this nifty debug screen to show:

autopilot-debug.jpg


And I found the option I wanted, which was the only reason I actually allowed the car to update to 7.1... (yes, I went through the staged binaries a bit before updating).

2016-01-09%2018.34.46-crop.jpg
This really needs to be an exposed toggle in the UI. In case it isn't obvious, this is the toggle that disables the stupid speed limit + 5 MPH autosteer restriction they just added (which was hard limited at 45 MPH initially in the betas apparently). Some proof of someone speeding in my P85D (I plead the 5th...):

2016-01-09-14-38-20.jpg


The little "Dev Readouts" dash app is actually not made for the dual motor cars and doesn't seem to have ever been updated, so some of the data is wrong. I'll probably make my own eventually.

I've got cross-compiling working and can run compiled code on the CID and IC now.

Code:
root@cid:/home/wk057# cat hello.c
#include <stdlib.h>
#include <stdio.h>

int main() {

printf("Hello Tesla World!\n");

return 0;

}


(--cross-compile on dev machine--)

root@cid:/home/wk057# ./hello
Hello Tesla World!
root@cid:/home/wk057#

And since the GUIs run on Xorg, pretty simple to overlay stuff on top of the Tesla UI. Especially on the IC where there is no input. I'll probably work on that at some point, but I did a hello world X version to make sure it worked and it works fine.

Let's see... what other goodies...

Can enable Spotify from the diagnostic screen. It replaces Slacker, which sucks. And the quality is terrible compared to Slacker. Terrible. I'm not one for being picky on sound quality, but, they definitely have Spotify set to a much lower bitrate. I didn't keep it enabled. I like Slacker better still. It should probably be an option, though, even for us USA folks. The Spotify search interface is certainly way cooler:

2016-01-09%2010.12.18-crop.jpg


That's about it for now. Still working on parsing some more CAN messages, too.
 
Impressive work. :scared:

engaging max battery power changes the battery pack heating target to 48C. It also bumps the passive and active cooling targets to 50C and 52C from 30C and 50C respectively. That's pretty crazy. Definitely not going to use this feature for much of anything. Definitely would not suggest it for pre-heating the pack like some have suggested.

48C ?! Very surprised, that seems like an excessive temperature to heat the pack to, but Tesla must know about the internal resistance of the cells well enough to know how to best get every last ounce of power out of them.


if range mode is on the car will not actively heat the pack even in max battery mode.

Confirms videos I've seen where Bjorn Nyland tested this to confirm the pack wasn't heated at all when range more was enabled.
 
Actually, the other buttons are just grayed out until you hit the "unlock features" button.

So no Summon from LA to NY then... Highly disappointing :)

Also doesn't seem like much training would be needed to press a button.

Very cool btw that you were able to activate Spotify on your US car. Tesla better not add any software without activating it (with plans to activate at a later point in time) because you'll surely find it.
 
And I found the option I wanted, which was the only reason I actually allowed the car to update to 7.1... (yes, I went through the staged binaries a bit before updating).

2016-01-09%2018.34.46-crop.jpg
This really needs to be an exposed toggle in the UI. In case it isn't obvious, this is the toggle that disables the stupid speed limit + 5 MPH autosteer restriction they just added (which was hard limited at 45 MPH initially in the betas apparently). Some proof of someone speeding in my P85D (I plead the 5th...):
I knew there had to be a way to disable it, there's no way that Elon is driving around with crippled AP on his car.
If I could access that toggle I would definitely upgrade to 7.1
 
Yeah, like I said, it needs to be a normal setting behind a bunch of "Are you sure?" type disclaimer popups.

Can actually disable all hands on requirements deeper in the autopilot dev app.... but I tried it for a little bit and it's actually kind of scary since it will never stop trying to drive until you take over or cancel or whatever. No warnings that it's getting incomplete info and such and no "take over immediately" or anything. So, leaving that one enabled. :p
 
  • Like
Reactions: NiallDarwin
Yeah, like I said, it needs to be a normal setting behind a bunch of "Are you sure?" type disclaimer popups.

Can actually disable all hands on requirements deeper in the autopilot dev app.... but I tried it for a little bit and it's actually kind of scary since it will never stop trying to drive until you take over or cancel or whatever. No warnings that it's getting incomplete info and such and no "take over immediately" or anything. So, leaving that one enabled. :p
Ideally I would disable the "45pmh rule" and the nags that are unrelated to confidence (not sure how granular the selection is) for example the nag on curve in 7.0 I would remove, and the reported additional nags from 7.1

I'm now quite jealous of the access you have to your car, and it just makes me even angrier that Tesla is denying such access to others who bought the car and aren't allowed to do what they want with their own property.
 
Amazing stuff. The label "45 mph rule" might explain some of the miscategorized roads I've seen locally. There is a divided road with a 45mph limit that limits one to +5mph and two different roads that have a 55mph limit that have no median and don't have the +5mph restriction.
 
wk057, I apologize if I missed it earlier in this thread (I looked but couldn't find it). How are you getting into the dev mode on your car? Did you write yourself a script that connects to Tesla VPN using the car keys you retrieved and grabs the daily security token? I always thought that token was the same for all cars. Is the token the code you punch in to the UI to get there?
 
Come on down! :D

Well, been investigating some stuff with my car's dev mode a little. Found something I found pretty interesting.

So, I set the cruise at 55 MPH on a road. With range mode OFF the car is not using the front motor at all. The front motor is sleeping. If I flip to range mode, the front motor takes over and the rear motor sleeps. Like, pretty much instantly and is imperceptible. In range mode the rear motor barely comes alive even during full regen where I saw the front motor alone putting out 72kW at one point today. During initial acceleration, unless it's very light, the rear motor will kick in for a short bit then go back to sleep. But in range mode ON the majority of the time it appears just the front motor is used and in range mode OFF the rear motor is mostly used. Kinda cool, and weird I guess.

That seem to match the sort of slow-motion video I did at 240 FPS. With range mode ON, the car always starts with the front. i.e. the front wheel spin first then I get power to the rear. The reverse is true when range mode is off.

We had another snow storm in eastern Canada yesterday and I had more time to test the car's behavior. When pushed (100% throttle) and already in a curve, the car does feel different with or without range mode. With range mode, it behaves like a front biased AWD : slight understeer followed by a bit of oversteer before the yaw stability engages. Without range mode, I get immediate oversteer and the oversteer has more time to develop (I probably get to around 15-20 degree or yaw "slip" vs 5-10) before the stability kicks in and starts pumping the brakes.

Slightly off topic but posting the video since we're talking about F/R power distribution :


- - - Updated - - -

wk057, I apologize if I missed it earlier in this thread (I looked but couldn't find it). How are you getting into the dev mode on your car? Did you write yourself a script that connects to Tesla VPN using the car keys you retrieved and grabs the daily security token? I always thought that token was the same for all cars. Is the token the code you punch in to the UI to get there?

He did not disclose his actual method but he described it as requiring physical access to the cluster / main screen interconnection.
 
Last edited by a moderator:
  • Informative
Reactions: NiallDarwin
And since the GUIs run on Xorg, pretty simple to overlay stuff on top of the Tesla UI. Especially on the IC where there is no input. I'll probably work on that at some point, but I did a hello world X version to make sure it worked and it works fine.
If you need help on low-level X-input stuff - feel free to ping me, I've spent around 2 years dealing with that stuff. With X you can do pretty much anything you want with the raw input.
 
....

So, I set the cruise at 55 MPH on a road. With range mode OFF the car is not using the front motor at all. The front motor is sleeping. If I flip to range mode, the front motor takes over and the rear motor sleeps. Like, pretty much instantly and is imperceptible. In range mode the rear motor barely comes alive even during full regen where I saw the front motor alone putting out 72kW at one point today. During initial acceleration, unless it's very light, the rear motor will kick in for a short bit then go back to sleep. But in range mode ON the majority of the time it appears just the front motor is used and in range mode OFF the rear motor is mostly used. Kinda cool, and weird I guess.
To me that sounds like there is no energy saved on the motor consumption on long trips using Range mode on/off. Either the front motor is used or the rear motor is used !?! I thought that both motor where used with range mode off, and only one of them where used with range mode on
 
To me that sounds like there is no energy saved on the motor consumption on long trips using Range mode on/off. Either the front motor is used or the rear motor is used !?! I thought that both motor where used with range mode off, and only one of them where used with range mode on

For the P cars the front motor is smaller and presumably more efficient overall (before even factoring in the different gear ratios). Would be interesting to know what happens with the regular D cars.
 
Ideally I would disable the "45pmh rule" and the nags that are unrelated to confidence (not sure how granular the selection is) for example the nag on curve in 7.0 I would remove, and the reported additional nags from 7.1

I'm now quite jealous of the access you have to your car, and it just makes me even angrier that Tesla is denying such access to others who bought the car and aren't allowed to do what they want with their own property.

There is no more granular control (that I could find anyway) for the nags. However, it appears to me that all of the nags are prompted by something important, including when taking a hard curve. There is a property for how much steering autopilot is allowed to do in a short time, and if it exceeds that it nags. This way if it's bouncing around or making a bunch of sharp corrections when it shouldn't it will eventually nag and/or disengage... which makes sense to me.

I've seen no evidence of additional nagging in 7.1.

wk057, I apologize if I missed it earlier in this thread (I looked but couldn't find it). How are you getting into the dev mode on your car? Did you write yourself a script that connects to Tesla VPN using the car keys you retrieved and grabs the daily security token? I always thought that token was the same for all cars. Is the token the code you punch in to the UI to get there?

At this time I won't be sharing exploits. I will note that the methods the Defcon folks used, including the ability to retrieve the security tokens from Tesla using the VPN keys, have all been patched and no longer work.

If you need help on low-level X-input stuff - feel free to ping me, I've spent around 2 years dealing with that stuff. With X you can do pretty much anything you want with the raw input.

I'm terrible with X, but I learn pretty quick. :) That said, I don't think Tesla is using X for touch input, only graphics display... not 100% sure though.

To me that sounds like there is no energy saved on the motor consumption on long trips using Range mode on/off. Either the front motor is used or the rear motor is used !?! I thought that both motor where used with range mode off, and only one of them where used with range mode on

Keep in mind that the motors in the P85D are different and the front motor actually is a bit more efficient. So primarily using the front motor in range mode makes sense.
 
For the P cars the front motor is smaller and presumably more efficient overall (before even factoring in the different gear ratios). Would be interesting to know what happens with the regular D cars.
It's the same for the regular "D" cars as well. You can actually hear it - the front motor is noticeably louder. The gains are smaller, but they're there.