Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Let the hacking begin... (Model S parts on the bench)

This site may earn commission on affiliate links.

wk057

Former Tesla Tinkerer
Feb 23, 2014
6,491
17,081
X
Greetings!

You folks all pretty much know me and my mountain of projects by now. Well, I've added one more to that ever growing list.

Behold! A Model S 17" MCU and IC running on the bench. :)

2015-12-14%2002.40.05-crop.jpg


And a short video of the minor success and tinkering I've done getting these guys running on the bench:

Tesla Model S Hacking - Running the MCU and IC on the Bench - YouTube

Nothing too exciting just yet, but this is step one for sure.

I sent the video and some pics to a friend earlier and his response was: "I think you might want to go in for service. The car appears to be missing." lol

At this time I've gotten a few things accomplished:


  • Figured out the power and ground wires that run the 17", IC, and built in audio amp.
  • Figured out the connections between the IC and the MCU.
    • There is a CAN pair, an ethernet connection (via that 4-pin connector), and a wake-up signal line
  • Wired up a speaker to the center channel.
    • The alert noise the car makes can be heard. Music plays via bluetooth. No radio since I don't have the radio module.
    • This is a premium audio MCU and actually has line-level outputs for the audio channels as well as amplified outputs... not sure the purpose of the latter in the premium audio setup.
  • Figured out how to "press the brake pedal" (or at least tell the IC that's what happened)

So far it's a short list, but I plan on expanding it greatly. Since I have this unit on the bench from a salvage vehicle I have no warranty fears and basically nothing to prevent me from tinkering. If I break it... oh well, I'm not down a vehicle.

Some goals:


  • Figure out the rear view camera stuff
    • An awesome but pretty unobtrusive hack would be to be able to display whatever we want in the Camera "app".
    • I'm envisioning an HDMI aux input port...
  • Gain access to the system software
    • It's been done, and this unit is on 6.1 still. So, should be possible but I'm not sure. I'm pretty capable. If there is a way in, I'll find it.
    • From here, any number of things is possible, and that list is pretty long.
  • Hardware mod to take over the display
    • A mod to the IC and/or the MCU could potentially allow utilization of the screens by a secondary processor. This could make it so a custom piece of hardware could overlay data on the screens, intercept touch commands if desired, etc, so that the interface can be modified in all sorts of cool ways. The best part about this would be that the hack wouldn't require breaking into the software running on the units, and thus wouldn't mess up any existing functionality or any warranty related things aside from the MCU/IC modifications.
  • Find a way to gather and decode technical data about the vehicle
    • I have tons of CAN logs from working Model S vehicles. Using my bench setup I could potentially start safely decoding what these commands mean.
      • For example, I can playback some of the log to the bench setup and see if there is any result. Like, let's say I have a hunch that a certain packet is telling the battery SoC. Well, I can play that to the bench CAN bus and see if if updates the SoC display.
  • Hack enough to potentially use these units in an EV conversion project
    • Probably ambitious... but have you seen my other projects? ;)

Lot's to be done. One of the things I'll need to be able to do is convince this setup to "start" the car. Currently it won't "start" when I "press" the brake pedal since there are a lot of things it can't communicate with. I'm hoping that I can fake it out by playing back portions of CAN logs from actual vehicles and maybe eventually get the IC to the "on" screen. Keep in mind that literally the only things I have hooked up currently are the MCU and IC. No other modules that would sit on the CAN buses. So everything it is displaying about the car (battery SoC, mileage, door positions, etc) is saved and displayed since it is the last thing it saw while it was connected and powered in the actual salvage vehicle.

Essentially one of my main goals with this is to find a way to add functionality to the units one way or another that can be utilized in a working car without causing any major concerns. Additionally I want to get a better understanding of everything that the car does (specifically on the CAN bus and the ethernet connections) to potentially be able to use that info for non-Tesla based diagnostic info and such. For example, I would really love to know what my pack voltage was at any given time, or the numeric power usage value.

Should be fun, and I welcome any insight anyone might have into how to go about some of the goals I've got planned, or otherwise. Additionally, if anyone is really interested in tinkering and is able to get here physically with whatever they'd want to use to tinker, I'm all for that. I really want this car to be less of a black box than it is today.

---

Edit: At some point my copyrighted externally hosted images were illegally copied from my external hosting and re-hosted directly by TMC without notice or permission. TMC was NEVER given permission to host and distribute my copyrighted images. I've corrected the image references. If my images are appropriated again without my permission I will be forced to take legal action. Unfortunately I can not edit some other posts to correct this, so I will be looking into remedies.
 
Last edited:
That looks like a bunch of fun. Goals are exactly what I'd do except I'd prioritize the software. Curious if it's 2 factor authentication. It looks like you are connected to your network in the video?? I wonder if it can be accessed remotely.
 
That looks like a bunch of fun. Goals are exactly what I'd do except I'd prioritize the software. Curious if it's 2 factor authentication. It looks like you are connected to your network in the video?? I wonder if it can be accessed remotely.

I haven't let the unit connect via the cell network or wifi. I only have it connected to my phone via bluetooth for tinkering with the audio outputs. I actually don't think I'm going to let it connect out to the internet at all.

As for the software, that's probably the most difficult part, so, probably working on that as time allows.
 
Cool!

I would love to see more pictures from the back and inside of these things :)

They also seem to be running at 3.16 amps at 13.7 volts, if I got that correctly from your video. That's about 43 watts, quite a bit for a car dashboard! I'm quite curious to see which of the two draws the majority of the power (probably that one with the 17" screen) and how much power they use when they are "off"
 
Cool!

I would love to see more pictures from the back and inside of these things :)

They also seem to be running at 3.16 amps at 13.7 volts, if I got that correctly from your video. That's about 43 watts, quite a bit for a car dashboard! I'm quite curious to see which of the two draws the majority of the power (probably that one with the 17" screen) and how much power they use when they are "off"

Yeah, working on that.

They are pretty power hungry. Fortunately low enough for my little cheap bench power supplies. Running at a total of 3.7A @ 13.8V right now, so 51W. That's with display brightness 50%. If I crank it to 100% it jumps up by 0.8A or 11W to ~62W! 0% brightness drops it to just under 3A total, or ~42W. So literally 20W difference between 0% and 100% brightness, which is kind of crazy. Means on a 4 hour drive, 0% vs 100% is the difference of about 1/4 mile of range. lol.

Also, keep in mind I don't have the GSM antenna connected, so it's likely using a little juice to try and contact AT&T towers as well.
 
  • Informative
Reactions: David99
This is a premium audio MCU and actually has line-level outputs for the audio channels as well as amplified outputs... not sure the purpose of the latter in the premium audio setup.

My guess would be that they don't make actually make different versions of the 17" unit for premium/non-premium sound versions. The premium sound version probably just has an amplifier hooked up to the line-level outputs and more and different speakers.

How many line-level outputs are there?
 
My guess would be that they don't make actually make different versions of the 17" unit for premium/non-premium sound versions. The premium sound version probably just has an amplifier hooked up to the line-level outputs and more and different speakers.

How many line-level outputs are there?

There are (edit, correction) five line level outputs that I've found and seven amplified outputs. The unit part number says it's a premium audio version. It is pretty likely they're mostly the same though.

Funny it thinks the passenger door is shut... LOL :)

Jeff

It definitely seems to have the last known state of everything cached.

Here is a composite of all of the errors I have now for laughs:

2015-12-14%2014.26.47-composite.jpg


It *really* wants me to contact Tesla service.... lol
 
That is so cool! Wish I could drop by ... but I live far, far way :rolleyes:
Where did you get these treasures?

How much power do the IC and MCU draw?
Edit: Looks like somebody asked before me!

I would like to know if the logs show battery balancing information. Could you add that to your list? :smile:
 
Last edited:
Latest comment from my witty friend: "hmm, 'car may be free rolling'. that explains why its missing" hahaha

That is so cool! Wish I could drop by ... but I live far, far way :rolleyes:
Where did you get these treasures?

How much power do the IC and MCU draw?

I would like to know if the logs show battery balancing information. Could you add that to your list? :smile:

Got them from a salvage S that was being parted out.

IC and MCU are drawing between 42 and 62W when on. I don't really have a way to make them sleep yet to check low power levels. Working on that.

And pulling logs is on my software hacks list, but that list is a mile long. :)
 
  • Like
Reactions: NiallDarwin
Ah, hours of entertainment. I need to go make some popcorn.

The line level outputs for the audio is interesting.

The IC is reporting the pack has 6 miles of range. I'm guessing that was the SOC of the pack that used to be connected? Cached data?
 
Ah, hours of entertainment. I need to go make some popcorn.

The line level outputs for the audio is interesting.

The IC is reporting the pack has 6 miles of range. I'm guessing that was the SOC of the pack that used to be connected? Cached data?

Yeah, there is an external amplifier (somewhere to the left of the steering column IIRC) that the line level outputs feed with the premium audio package.

Lots of stuff seems cached, like SoC, mileage, door positions, nav position.

But now that I I have the thing "started" I'm going to try and play some CAN data to it and figure out one of my big CAN decoding mysteries: Power usage. If I can get the little orange bar to move that'll be awesome. :)

- - - Updated - - -

Managed to get it up to throwing 11 errors when I cut off the accessory 12V rail while things were running. That's got to be some kind of record...