It also seems to me (correct me if I'm wrong) in my experience that it doesn't take much slushy, wet snow to coat the front facing radar which, in the current operation/configuration, then shuts the whole system down leaving the user without even basic cruise control.
-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
It also seems to me (correct me if I'm wrong) in my experience that it doesn't take much slushy, wet snow to coat the front facing radar which, in the current operation/configuration, then shuts the whole system down leaving the user without even basic cruise control.
For the third time, we need more background. How old is the car? Is this the original MCU? When did it happen? What exactly are the symptoms? And so on.
I can't swirl my mind up into a large smokey vortex and cast it out across the Atlantic Ocean to yours and extract this information against your will.
I can't swirl my mind up into a large smokey vortex and cast it out across the Atlantic Ocean to yours and extract this information against your will.
Model S 2015/06, the MCU is the original.
The car was half a year without 12V power, not working, then when connected sometimes it turns on, sometimes no, after September it never turned on again.
Now it starts IC but never the UMC.
It "try" to start, the 2 fans blink and stop immediately.
The interior LEDs flashes, and some check LEDs dont turn on.
Did you buy it salvage? was it in a wreck? what kind of damage? the LED picture isn't telling us much sadly. you need to tell us much more about the car
It have water inside him..
Damage on board charger and driver seat module that I already replace it.
Now I'm thinking in buying a used US MCU with cracked screen to put my screen on it.
Not a problem if I put my EU GSM modem and program it to my EU car right?
Or do you think may have a solution for my UMC ?
It stops working in September.. until that it works fine..
Did you ever figure out a way to get the SoC of the individual battery packs? Really curious to understand how the BMS works when you charge and when you discharge the battery.
Really cool work. Thanks for sharing.
Really cool work. Thanks for sharing.
Greetings!
You folks all pretty much know me and my mountain of projects by now. Well, I've added one more to that ever growing list.
Behold! A Model S 17" MCU and IC running on the bench.
View attachment 161614
And a short video of the minor success and tinkering I've done getting these guys running on the bench:
Tesla Model S Hacking - Running the MCU and IC on the Bench - YouTube
Nothing too exciting just yet, but this is step one for sure.
I sent the video and some pics to a friend earlier and his response was: "I think you might want to go in for service. The car appears to be missing." lol
At this time I've gotten a few things accomplished:
- Figured out the power and ground wires that run the 17", IC, and built in audio amp.
- Figured out the connections between the IC and the MCU.
- There is a CAN pair, an ethernet connection (via that 4-pin connector), and a wake-up signal line
- Wired up a speaker to the center channel.
- The alert noise the car makes can be heard. Music plays via bluetooth. No radio since I don't have the radio module.
- This is a premium audio MCU and actually has line-level outputs for the audio channels as well as amplified outputs... not sure the purpose of the latter in the premium audio setup.
- Figured out how to "press the brake pedal" (or at least tell the IC that's what happened)
So far it's a short list, but I plan on expanding it greatly. Since I have this unit on the bench from a salvage vehicle I have no warranty fears and basically nothing to prevent me from tinkering. If I break it... oh well, I'm not down a vehicle.
Some goals:
- Figure out the rear view camera stuff
- An awesome but pretty unobtrusive hack would be to be able to display whatever we want in the Camera "app".
- I'm envisioning an HDMI aux input port...
- Gain access to the system software
- It's been done, and this unit is on 6.1 still. So, should be possible but I'm not sure. I'm pretty capable. If there is a way in, I'll find it.
- From here, any number of things is possible, and that list is pretty long.
- Hardware mod to take over the display
- A mod to the IC and/or the MCU could potentially allow utilization of the screens by a secondary processor. This could make it so a custom piece of hardware could overlay data on the screens, intercept touch commands if desired, etc, so that the interface can be modified in all sorts of cool ways. The best part about this would be that the hack wouldn't require breaking into the software running on the units, and thus wouldn't mess up any existing functionality or any warranty related things aside from the MCU/IC modifications.
- Find a way to gather and decode technical data about the vehicle
- I have tons of CAN logs from working Model S vehicles. Using my bench setup I could potentially start safely decoding what these commands mean.
- For example, I can playback some of the log to the bench setup and see if there is any result. Like, let's say I have a hunch that a certain packet is telling the battery SoC. Well, I can play that to the bench CAN bus and see if if updates the SoC display.
- Hack enough to potentially use these units in an EV conversion project
- Probably ambitious... but have you seen my other projects?
Lot's to be done. One of the things I'll need to be able to do is convince this setup to "start" the car. Currently it won't "start" when I "press" the brake pedal since there are a lot of things it can't communicate with. I'm hoping that I can fake it out by playing back portions of CAN logs from actual vehicles and maybe eventually get the IC to the "on" screen. Keep in mind that literally the only things I have hooked up currently are the MCU and IC. No other modules that would sit on the CAN buses. So everything it is displaying about the car (battery SoC, mileage, door positions, etc) is saved and displayed since it is the last thing it saw while it was connected and powered in the actual salvage vehicle.
Essentially one of my main goals with this is to find a way to add functionality to the units one way or another that can be utilized in a working car without causing any major concerns. Additionally I want to get a better understanding of everything that the car does (specifically on the CAN bus and the ethernet connections) to potentially be able to use that info for non-Tesla based diagnostic info and such. For example, I would really love to know what my pack voltage was at any given time, or the numeric power usage value.
Should be fun, and I welcome any insight anyone might have into how to go about some of the goals I've got planned, or otherwise. Additionally, if anyone is really interested in tinkering and is able to get here physically with whatever they'd want to use to tinker, I'm all for that. I really want this car to be less of a black box than it is today.
I was going to suggest a short, as a surge of power and immediate kill-switch behavior feels like a short or overvoltage protection. Water damage could do it, even condensation or leaving the windows open at the salvage yard could pose problems like this?
Not an expert by any means...
It stopped working before or after the water? How high did the water get?
If it were me I'd use the process I described in the Salvage Car Owner's thread to copy, upgrade, and root the CID. (daughterboard in the MCU) When you have a black screen it almost always means the CID is not booting. Your car is not in the age range where I'd expect that the eMMC flash is worn out but we have no way of knowing, so I'd start by checking the firmware in the eMMC.
If you don't have Linux skills you might send your MCU to a hacker in Europe like GeorgeCM or nemSoma, and expect to compensate them for their time. May well be cheaper than another MCU, but then you may need another MCU anyway.
You can put a US MCU in your car but a number of settings must be changed. Of course you'd need an MCU with the same part# and it would need to be rooted to make the changes. Really a job for an expert. Yes you can drop in your GSM card with no other special actions.
If it were me I'd use the process I described in the Salvage Car Owner's thread to copy, upgrade, and root the CID. (daughterboard in the MCU) When you have a black screen it almost always means the CID is not booting. Your car is not in the age range where I'd expect that the eMMC flash is worn out but we have no way of knowing, so I'd start by checking the firmware in the eMMC.
If you don't have Linux skills you might send your MCU to a hacker in Europe like GeorgeCM or nemSoma, and expect to compensate them for their time. May well be cheaper than another MCU, but then you may need another MCU anyway.
You can put a US MCU in your car but a number of settings must be changed. Of course you'd need an MCU with the same part# and it would need to be rooted to make the changes. Really a job for an expert. Yes you can drop in your GSM card with no other special actions.
Last edited:
Thanks a lot for your help mate.
MCU stopped working long after the water damage.
Water was until half of the onboard charger, low level. Don't touch the body control. Just damaged the onboard charger and driver seat module.
I will find a way check the firmware in the eMMC.
Don't have linux skills to check it, I already send PM to EU hackers that u indicate.
If there is anything that can help them do their job.
Last edited:
Well, There seems to be interest over in the Salvage Car Owners' thread so I'm about to fill in some more info. (If the Powers That Be don't stop me)
I've already detailed one method there, removing the eMMC (flash) chip, putting it in a reader/writer, saving the data, and moving it to a better chip. As these cars age, more and more eMMCs will 'wear out' and this procedure is mandatory to fix this problem, as long as you do it before total failure.
This thread is the wrong place to go into it. This is where wk is supposed to be sharing.
I've already detailed one method there, removing the eMMC (flash) chip, putting it in a reader/writer, saving the data, and moving it to a better chip. As these cars age, more and more eMMCs will 'wear out' and this procedure is mandatory to fix this problem, as long as you do it before total failure.
This thread is the wrong place to go into it. This is where wk is supposed to be sharing.
pupik
Member
Disabling logging requires root/linux access. TBH, I'm not sure why Tesla doesn't do this already on every car...
Because they’d lose the logs on every reboot and then be unable to blame owners for the AP failures
Because they’d lose the logs on every reboot and then be unable to blame owners for the AP failures
So log remote? (and write some code to persist locally in the event of a crash?)
Shhh, that would require planning, testing and a roadmap....
Thank appleguru
Is this possible through Tesla Service Cable Ethernet FakraHSD?
