-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pictures of the Tesla Model 3 MCU board, SD card, HRL and flashing LEDs #3
Comments
I found this thanks to Github emailing me because of the mention. I would love to help figure things out especially if I can help on the hardware side. |
The chip with IMEI is obviously the LTE modem! Wifi is somewhere else? |
@rkantos Looks like you are right! Googling for "LE940B6" says it's a module supporting "multi-band LTE Cat 6 with 3G/2G fallback". I think I got distracted by the fact that the SIM card is on the MCU board itself, but that doesn't require high bandwidth, so locality doesn't matter. WiFi/Bluetooth is presumably part of the Intel SoC. |
The salvaged MCU doesn’t have J32 and the white plug because it’s an old HW2 MCU your is HW2.5 |
To me, who has literally no experience in designing PCBs or anything like that, but who has seen a bunch of teardown of different kind of hardware; All these PCBs look like are something between a tablet and a laptop in terms of design and component placement. Also up until AP HW3, most layouts seem to just be based on typical reference designs (by Nvidia or Intel), as in the past they reminded me closely of a GPU or Intel NUC/UDOO x86 sbc. Now since HW3, the autopilot design is something like I've never seen before, obviously displaying that it is most likely a Tesla design from the start. Now only the MCU looks like a reference design from Intel. |
How hard would it be to replace the sim card , have a car from another country would love my own countrys cards instead. Looking for instructions or at least good pointers :) |
Have you try it? Thanks |
Based on the videos I've seen, it shouldn't be too difficult to get to the sim card. If you look at the pictures carefully, you can see that the sim card is on the upper right hand side part of the module (facing inside) on the 3rd picture. As the whole module is designed to be swapped, it isn't too difficult to get to. The only thing that one has to remember really is that the whole thing is liquid cooled, and while it might be possible to get to the sim card without disconnecting the water lines, it is probably best to to disconnect the 12V power completely when taking it apart. I am a bit surprised that there isn't a video of taking the Model 3 apart yet on Youtube; Not that I am aware anyway! |
Yes it shouldn't be too dificult to get the sim. |
For the sake of completeness: The chip right next to the eMMC (marked as Turns out, if you short this one to GND, your MCU will not boot anymore. Like at all. Ever. So, you know, don't do this 🤦♂ |
ohh man ! that sucks , sorry to hear. :( |
For me I am interested to replace the Sim card if any one enable to do it I need to know the steps and if there is video will be great |
Oh! Which pin did you short exactly? |
Also wondering about this @0ff |
@bequa / @davidh- sorry for my late response. My best guess was that Once I've shorted this to GND via a resistor, this happened (on that particular boot):
This was exactly what I was looking for - the boot loader was forced into booting without SPI and this would enable the CLI (command line interface) if it was enabled.
Very rarely this happens and then the units reboots ~20 times before going back to the above:
|
Is the ABL bootloader stored on the SPI flash? |
Is the ABL bootloader stored on the SPI flash? |
Regarding the SPI flash, according to the documentation at https://www.micron.com/products/nor-flash/serial-nor-flash/part-catalog/mt25qu128aba8e12-0aat It looks like pin 8 is the reset and hold pin, which would possibly explain why you can't boot anymore @0ff? |
@lewurm |
I am thankful to this blog giving unique and helpful knowledge about this topic. |
Do you have a pin out for the SPI? I’m trying to write to an SPI on an MCU2, but would guess it’s slightly similar to the M3 board. Thanks |
have you try it? Do you have any result? |
Shortly after I've posted #1 I had to travel to the United States for business. Coincidentally I stumbled over a MCU+AP unit on eBay salvaged from a crashed Model 3. Located somewhere on the east coast; shipping to Europe was too expensive, but luckily I had this business trip lined up!
Pics or it didn't happen
Around VIN 51xxx. Upper ports belong to APU (autopilot unit), bottom ports belong to MCU (media control unit).
![IMG_0149](https://user-images.githubusercontent.com/75403/62827586-0866ec80-bbd2-11e9-92ac-2f9257272fe3.JPG)
Left belongs to MCU, right side to APU. The upper two ports are bridged.
![IMG_0150](https://user-images.githubusercontent.com/75403/62827601-6b588380-bbd2-11e9-8d75-c039ee4b483a.JPG)
Whole package (not my lab that you see in the background unfortunately):
![IMG_0175](https://user-images.githubusercontent.com/75403/62827609-77444580-bbd2-11e9-9201-aceb800f9852.JPG)
As I found out latter by comparing some pics from the unit of my actual car (VIN 196xxx) it looks like it already has a different hardware revision:
J32 and the white plug above it do not exist on the salvaged MCU. Maybe it's a difference regarding region (EU).
Back to the salvaged MCU, that's how it looks like when you open it up.
![IMG_0179](https://user-images.githubusercontent.com/75403/62827612-80351700-bbd2-11e9-8465-c028658e517a.JPG)
... except that I removed already this (WiFi/Bluetooth? EDIT: It's the LTE chip. The datasheet for LE940B6 clearly states that. Thanks @rkantos ):
![IMG_0176](https://user-images.githubusercontent.com/75403/62827614-86c38e80-bbd2-11e9-9c73-15d3b4ed3864.JPG)
And when you flip it:
![IMG_0182](https://user-images.githubusercontent.com/75403/62827616-8aefac00-bbd2-11e9-8315-2705b08ff402.JPG)
Here is the Intel SoC:
![IMG_0181](https://user-images.githubusercontent.com/75403/62827617-9216ba00-bbd2-11e9-8830-52ccd7ee4271.JPG)
And finally, I uploaded several close-ups of the MCU for detailed studies:
I'll do the same for the APU another day.
As you might have noticed, there is a SD card. Let's dig into it.
Exploring the content of the SD card
I was hoping to find something similar to this: https://youtu.be/Kv_y7J9ROxk?t=558
Unfortunately it looks a bit different:
Those
HRL
files look interesting, there are around 50 in this folder. The files are around 600K-1000K big, so those could be images, right? Well,file
andbinwalk
detected nothing like a picture. Bummer.Then I was wondering what those filenames could mean, they kinda look sequential. Also it looks like a hex number. Hmm:
Interesting.
I looked a bit at its hexdump, but except for the VIN (which matches with the label on the MCU) and some unix time stamps I didn't find much. Searching for "HRL file format" or "HRL Tesla" doesn't give any useful results. Seems like on one hasn't touched those yet? I pinged my friends @gilles-duboscq and @sanzinger. They did the following awesome work:
https://github.com/lewurm/toolsa/
In essence it's some sort of log files that contains records. A record looks like this:
An example is the VIN:
VINRecord
is signed up forid
0x3c05
and0xbc05
. If it reminds you of CAN bus messages, you are not wrong:This is from the amazing Model 3 CAN bus sheet put together by @joshwardell et al.: https://docs.google.com/spreadsheets/d/1ijvNE4lU9Xoruvcg5AhUNLKr7xYyHcxa8YSkTxAERUw/edit?usp=sharing
It looks like it wouldn't match the CAN ID here, but the lower 11 bits do:
The upper part seems to identify something else. Another thing that seems to match is the CAN ID for tire pressure. Snippet of the output by
hrl-parser.py
:assuming it's
bar
* 10⁴, this looks plausible.There are many more records to uncover, but it's pretty clear now that we won't find pictures here, so we stopped digging further. PRs are welcome though 🙂
Oh and by the way, if anyone knows what
HRL
stands for, please let us know. @teslamotors? 😬Other stuff on the SD card
There are other interesting things on the SD card which we haven't looked into yet:
BOOTED.IMG
could be the firmware for the gateway? As far as I know it runs on a PowerPC e200 core, but I couldn't identify anything useful after a quick look.0.LOG
/1.LOG
are300MB
/140MB
big. What's in there?If you want to have a copy of the SD card dump, let me know: lewurm AT gmail DOT com. Not sure if it's okay to put it into the wild...
Let's power up the MCU
Disclaimer: My hardware knowledge is rusty, I'm a lazy software bastard now. Thus my equipment is not the best. I made an educated guess that I'll need to power it up with 12V (you know, it's in a car), and I had some crappy power supply lying around that supposedly should provide 12V.
There is a telling
J1 CAN/POWER
port on the board.GND
was found quickly.J1
has 12 pins, minus two forGND
, there are only 10 candidates left. None of them worked. Wut?Well, I'm smarter now (thanks again to Stefan and Gilles):
And with that it was not that hard. Since I've spent some time looking around on the board, I identified some more pins on the female
J1
plug:And 🎉: Some LEDs are flashing! More about it next time.
The text was updated successfully, but these errors were encountered: