Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Let the hacking begin... (Model S parts on the bench)

This site may earn commission on affiliate links.
That's probably possible too. Once I nail down the rear cam communication that would be a logical next step. Anyone have a spare rear cam? :)

I think I may have one in my spare parts bin. I'll take a look tomorrow.

if you can find a solution to the camera input all kinds of possibilities arise -- video displays on the touchscreen, touchscreen dash cam, etc. Aren't there a number of unused inputs on the back? I've always wondered what they're for.

I'll be following you work closely along with what appears to be a growing crowd:)
 
Can't imagine Tesla re-invented the wheel, so my money is on the rear view camera being a regular UVC compatible camera connected via USB to the MCU and then they're using the UVC driver that already in a standard Linux kernel.
 
I'm curious if you could just swap screens/MCUs with a salvage part if yours were to die out of warranty. Would you have to find one with the same options like sunroof/suspension etc?

The IC and MCU seem to be a pair based on everything I've gathered. Firmwares would have to match and all. I'll see what else I can come up with on that front later.

Something tells me you will soon be able to adjust your wife's performance driver's seat :)

Possibly. It's on the list. I may tie it into my setup here shortly to test things out. :)

I think I may have one in my spare parts bin. I'll take a look tomorrow.

if you can find a solution to the camera input all kinds of possibilities arise -- video displays on the touchscreen, touchscreen dash cam, etc. Aren't there a number of unused inputs on the back? I've always wondered what they're for.

I'll be following you work closely along with what appears to be a growing crowd:)

Yeah, I figure using the camera to get something to show on the 17" is a step in the right direction, even if it's a limited application. Thanks. :)

Can't imagine Tesla re-invented the wheel, so my money is on the rear view camera being a regular UVC compatible camera connected via USB to the MCU and then they're using the UVC driver that already in a standard Linux kernel.

That's quite possible. The cable suggests a differential data connection.

Curious if there's an input there that could grab AP front camera output.

The front camera setup seems to only be connected to the systems via CAN. I doubt they're going to stream camera output over the 500kbit/sec CAN bus it's connected to.
 
Oh yes. Subscribed.
popcorn-and-drink-smiley-emoticon.gif
 
DO NOT connect to wireless OR cellular. I seem to remember a guy buying a salvage Model S that drove around his garage fine with errors until he connected to the internet and Tesla shut it down.

Agree. Definitely not cell although that AT&T module has probably been de-provisioned by now. But you could attach it to an internal wifi network on your router that isn't connected to the Internet.
 
Yeah, that's not going to happen. No connectivity for this guy.

So, I was driving my fake Model S around at 255 MPH with the cruise control on pulling 320 kW with the hood, trunk, and three doors open, no brakes, flat tires, with no seat belts or air bags...

2015-12-14%2022.44.05-1920.jpg


Fun times... :p

The odometer runs while I mess with this. 1 mile added every 14 seconds... lol.
 
Did you also get the battery from that vehicle for your other project or are you still waiting to hear back from Tesla on that? I imagine if you negotiated that large salvage battery purchase, you could possibly have got these goodies thrown in for not too much more to allow for the fun you are now having.
 
Yeah, I was honestly thinking the same thing when I came up with the initial idea. Would require a switch of some kind to toggle between the rearview cam and the connected HDMI device, though, which would likely have three settings: Rear, Aux, Auto... where auto would default to the rear cam when nothing was connected to the aux HDMI.

Honestly, this will probably be the easiest part once I get a hold of a rear cam to play with...

I don't know how much you followed artsci's thread on the front camera switch, so it's possible you know all this, but just in case you don't, I thought I'd share...

My understanding (and since artsci is following this thread, he can correct whatever I get wrong or can just fill in the gaps) is that when they were working on the original front camera switch they couldn't get the display to work with anything other than the same rear camera Tesla was using. So the switch wound up being designed to use the rear camera on the front of the car, as that was the only video signal they were able to get to display on the 17" screen.

I'm just pointing this out, in case you knew nothing about all that, in which case what you're thinking may be the easiest part may prove not to be so easy after all.
 
Yeah, this is from a pre-autopilot car (not too far behind really) that is still on v6.1.

The Line outs are in shielded wire in their own 20 pin connector on the back of the MCU. No RCAs, although that would've been nice.

XM/AM/FM appear to come from a separate radio module. There are left and right line inputs (in another harness) that come from that module (I don't have it) along with line inputs from driver and passenger microphones.

if you could find a way to splice into the line inputs everyone with an iPod or non-Bluetooth device would love to get that hack. Perhaps a switchbox that intercepts the radio line and switches to an aux input when you want to listen to your iPod then you could flip the switch and go back to the radio
 
Did you also get the battery from that vehicle for your other project or are you still waiting to hear back from Tesla on that? I imagine if you negotiated that large salvage battery purchase, you could possibly have got these goodies thrown in for not too much more to allow for the fun you are now having.

I didn't pick up the battery from this salvage since it was already sold. As for the deal with the 90 pack swap with Tesla and keeping my 85 pack... I'm not getting my hopes up. Probably will hunt for a pack for my project once I get closer to the point of actually needing one to install.

I don't know how much you followed artsci's thread on the front camera switch, so it's possible you know all this, but just in case you don't, I thought I'd share...

My understanding (and since artsci is following this thread, he can correct whatever I get wrong or can just fill in the gaps) is that when they were working on the original front camera switch they couldn't get the display to work with anything other than the same rear camera Tesla was using. So the switch wound up being designed to use the rear camera on the front of the car, as that was the only video signal they were able to get to display on the 17" screen.

I'm just pointing this out, in case you knew nothing about all that, in which case what you're thinking may be the easiest part may prove not to be so easy after all.

Yeah, I don't know the details. It just looks like a low voltage differential data link. Since I'm not messing with my actual car to get details I'll have to wait until I get a Tesla rear cam to mess with.

So, I guess speed is stored as just one byte?

That's amazing stuff you're doing. Care to summarize what you sent to the console to make it drive that fast and use that much energy? Are those two things related or independent?

Yep, speed is sent as one byte. There are a couple of bytes for the analog speed readout (which I can send to be in a different position than speed), a couple of bytes for the position of the cruise setting, and a flag for cruise enabled. That's all one CAN packet, ID 0x0256 on CAN bus 3.

The power meter is a little more annoying. I figured out the signal for it... but haven't nailed down the encoding of it. Was tweaking bytes to get some results and was just scratching my head.

Turns out this packet on a P85D is different than the packet this bench setup expects. The P85D sends an 8 byte packet, where a CAN log I have from another vehicle that someone sent me a while back shows it as a 6 byte packet. Not enough data yet to really figure out exactly how to finely manipulate the power meter. :(

In case anyone else wants to take a crack at it... here is that packet logged from a P85D: http://skie.net/uploads/powermetercan.txt

Starts sitting still, slowly up to ~20 MPH, then full throttle to 60 MPH (power ramp starts around packet 715 or so), then full regen to ~40 MPH, then some normal driving and finally stopping again. I don't have a P85D that I'll play CAN packets to, so, can't really test the results. But I know for sure that this is the only packet needed to move the power meter on my bench setup. Good luck. Maybe I'm just sleepy, but I couldn't figure out exactly what the values worked out to be. Definitely the first 4 bytes turn into the power meter read out. It's definitely not quite right on the bench IC, since full power from the P85D log ends up at ~60kW on the bench display. I'll have to log from a non-D one of these days.

if you could find a way to splice into the line inputs everyone with an iPod or non-Bluetooth device would love to get that hack. Perhaps a switchbox that intercepts the radio line and switches to an aux input when you want to listen to your iPod then you could flip the switch and go back to the radio

Probably pretty doable, but probably not really worth it given the bluetooth audio stuff, IMO.
 
I only have the CAN bus connected between the MCU and the IC currently. I'm working on getting some CAN sniffers/injectors setup now for that bus and the other *four* (five total) CAN buses on this car. Probably will be a few days before I actually have time to tinker with all of the CAN stuff.

Not sure what you mean by "the servo controller." There appear to be five CAN bus connections and some LIN connections on the MCU. The LIN stuff looks to work for homelink, the seat heaters, the electrochromatic mirror dimmers, and some 12V battery monitoring system I'm unsure about.

The front louver flap actuators are also LIN bus too.
 
if you could find a way to splice into the line inputs everyone with an iPod or non-Bluetooth device would love to get that hack. Perhaps a switchbox that intercepts the radio line and switches to an aux input when you want to listen to your iPod then you could flip the switch and go back to the radio

Just to add to what wk57 said -- there are hundreds if not more small and cheap Bluetooth devices out there to do exactly what you want -- no need to splice into the line inputs to create an AUX input. And most of them are powered/charged via micro-USB, so that's easy to do in the car.