Pictures of the Tesla Model 3 MCU board, SD card, HRL and flashing LEDs #3

Shortly after I’ve posted #1 I had to travel to the United States for business.
Coincidentally I stumbled over a MCU+AP unit on eBay salvaged from a crashed Model 3. Located somewhere on the east coast; shipping to Europe was too expensive, but luckily I had this business trip lined up!

softool.cn Notes:
Coincidentally 英 [kəʊˌɪnsɪ’dentəlɪ] 美 [koʊˌɪnsɪ’dentəlɪ] adv.巧合地; 同时发生地; 一致地;
stumble 英 [ˈstʌmbl] 美 [ˈstʌmbəl] vi.跌跌撞撞地走，蹒跚; 结巴; 弄错，失足; 偶然碰见; 错过;n.绊脚，失足; 差错，失误; 过失，失败;
crashed [kræʃt] v.（使）猛撞， （使）撞毁( crash的过去式和过去分词 ); 撞坏; 猛冲直撞; 发出巨响;

Pics or it didn’t happen

Around VIN 51xxx. Upper ports belong to APU (autopilot unit), bottom ports belong to MCU (media control unit).

Left belongs to MCU, right side to APU. The upper two ports are bridged.

Whole package (not my lab that you see in the background unfortunately):

As I found out latter by comparing some pics from the unit of my actual car (VIN 196xxx) it looks like it already has a different hardware revision:

softool.cn Notes:
latter 英 [ˈlætə(r)] 美 [ˈlætɚ] adj.后者的; 末了的; 较后的;

J32 and the white plug above it do not exist on the salvaged MCU. Maybe it’s a difference regarding region (EU).

Back to the salvaged MCU, that’s how it looks like when you open it up.

… except that I removed already this (WiFi/Bluetooth? EDIT: It’s the LTE chip. The datasheet for LE940B6 clearly states that. Thanks @rkantos ):

And when you flip it:

softool.cn Notes:
flip 英 [flɪp] 美 [flɪp] vt.轻弹，轻击; 按（开关）; 翻转; 急挥;vi.发疯; 急动; 捻; 蹦蹦跳跳;
n.浏览; 空翻; （射击时枪管的）跳跃; 轻抛;adj.[口语]无礼的，轻率的，油腔滑调的; 冒失的，鲁莽的;

Here is the Intel SoC:

And finally, I uploaded several close-ups of the MCU for detailed studies:

softool.cn Notes:
close-up 英 [ˈkləʊs ʌp] 美 [ˈkloʊs] n.[影视]特写镜头; 〈美俚〉精密观察; 小传;

• front: https://imgur.com/a/I6FtxPq There is some duplication as I tried different settings on the camera.
• back: https://imgur.com/a/NPpcdeK

I’ll do the same for the APU another day.

As you might have noticed, there is a SD card. Let’s dig into it.

Exploring the content of the SD card

I was hoping to find something similar to this: https://youtu.be/Kv_y7J9ROxk?t=558

Unfortunately it looks a bit different:

$ tree m3-mcu-sdcard/
/tmp/m3-mcu-sdcard
├── 0023
├── 002A
├── 002E
├── BOOTED.IMG
├── CBREAKER.MAP
├── HRL
│   ├── 5BD3E9B4.HRL
│   ├── 5BD3E9D2.HRL
│   ├── 5BD3EA3D.HRL
│   ├── 5BD3EA4E.HRL
│   ├── 5BD3EA59.HRL
[.......]
│   ├── CUR.HRL
├── LOG
│   ├── 0.LOG
│   ├── 1.LOG
│   └── LOGINFO.TXT
├── MAP.TSV
├── MODINFO.LOG
├── UDSDEBUG.LOG
└── UPDT

Those HRL files look interesting, there are around 50 in this folder. The files are around 600K-1000K big, so those could be images, right? Well, file and binwalk detected nothing like a picture. Bummer.

Then I was wondering what those filenames could mean, they kinda look sequential. Also it looks like a hex number. Hmm:

$ date -r `printf "%d" 0x5BD3E9B4`
Sat Oct 27 06:29:40 CEST 2018

Interesting.

I looked a bit at its hexdump, but except for the VIN (which matches with the label on the MCU) and some unix time stamps I didn’t find much. Searching for “HRL file format” or “HRL Tesla” doesn’t give any useful results. Seems like on one hasn’t touched those yet? I pinged my friends @gilles-duboscq and @sanzinger. They did the following awesome work:

softool.cn Notes:
awesome 英 [ˈɔ:səm] 美 [ˈɔsəm] adj.令人敬畏的; 使人畏惧的; 可怕的; 极好的;

https://github.com/lewurm/toolsa/

In essence it’s some sort of log files that contains records. A record looks like this:

----------------------------------------
|| 1 byte   | 4 bytes ||    11 bytes   |
|| sequence | id      ||    payload    |
----------------------------------------
An example is the VIN:

class VINRecord(RecordInterpreter):
    def to_str(self, rec):
        type = ord(rec.rest[0])
        if type == 0x11:
            return "Model: " + rec.rest[1:]
        elif type == 0x12:
            return "Serial: " + rec.rest[1:]
        elif type == 0x10:
            assert rec.rest[1:5] == '\0\0\0\0'
            return "Manufacturer: " + rec.rest[5:]
        else:
            raise RuntimeError("unexpected VIN record type: {:02x} '{}'".format(type, rec.rest[1:]))
#[...]
_record_interpreters = {
    0x1d28: UnixTimeStampRecord(),
    0x3c05: VINRecord(),
    0xbc05: VINRecord(),
    0xb84f: GPSRecord(),
    0x3b18: OtherTimeStampRecord(),
    0xbb1f: TyrePressureRecord(),
}

VINRecord is signed up for id 0x3c05 and 0xbc05. If it reminds you of CAN bus messages, you are not wrong:

This is from the amazing Model 3 CAN bus sheet put together by @joshwardell et al.: https://docs.google.com/spreadsheets/d/1ijvNE4lU9Xoruvcg5AhUNLKr7xYyHcxa8YSkTxAERUw/edit?usp=sharing

It looks like it wouldn’t match the CAN ID here, but the lower 11 bits do:

$ printf "0x%x\n" $(( 0x3c05 & 0x5ff))
0x405
$ printf "0x%x\n" $(( 0x3c05 >> 11))
0x7

The upper part seems to identify something else. Another thing that seems to match is the CAN ID for tire pressure. Snippet of the output by hrl-parser.py:

Record 24   TyrePressureRecord: 28988 / 28989 / 28733 / 28989

assuming it’s bar * 10⁴, this looks plausible.

There are many more records to uncover, but it’s pretty clear now that we won’t find pictures here, so we stopped digging further. PRs are welcome though ?

Oh and by the way, if anyone knows what HRL stands for, please let us know. @teslamotors? ?

Other stuff on the SD card

There are other interesting things on the SD card which we haven’t looked into yet:

• BOOTED.IMG could be the firmware for the gateway? As far as I know it runs on a PowerPC e200 core, but I couldn’t identify anything useful after a quick look.
• 0.LOG/1.LOG are 300MB/140MB big. What’s in there?

If you want to have a copy of the SD card dump, let me know: lewurm AT gmail DOT com. Not sure if it’s okay to put it into the wild…

Let’s power up the MCU

Disclaimer: My hardware knowledge is rusty, I’m a lazy software bastard now. Thus my equipment is not the best. I made an educated guess that I’ll need to power it up with 12V (you know, it’s in a car), and I had some crappy power supply lying around that supposedly should provide 12V.
There is a telling J1 CAN/POWER port on the board. GND was found quickly. J1 has 12 pins, minus two for GND, there are only 10 candidates left. None of them worked. Wut?

Well, I’m smarter now (thanks again to Stefan and Gilles):

12V needs to be pretty stable.
You’ll need more than one ampere.
And with that it was not that hard. Since I’ve spent some time looking around on the board, I identified some more pins on the female J1 plug:

----------------------------------------------------------------
| 1: ? | 3: ?   | 5: V12 | 7: ?      | 9:  CANLo1 | 11: CANHi1 |
| 2: ? | 4: GND | 6: GND | 8: CANLo2 | 10: CANHi2 | 12: ?      |
----------------------------------------------------------------

And ?: Some LEDs are flashing! More about it next time.

来源:
https://github.com/lewurm/blog/issues/3