Hacking my Tesla Model 3 - Software Modes

As part of reverse engineering the Tesla Model 3 internals, I’ve been running a subset of the CID car services to see how they work.

The car computers are using Intel Atom based processors so it’s easy to setup a chroot to launch the services.

I’ve written two helper scripts to set up the car environment:

• chroot.sh - runs a command in the Tesla chroot environment.
• start_car.sh - runs the main vehicle services: escalator, ecall_client, sim_service, carserver, vehicle. Other services can be launched via ./chroot.sh /usr/tesla/UI/RunQtCar

上面两个脚本，详见附件。

These scripts assume a CID image is extracted at squashfs-root/.

softool.cn Notes:
assume 英 [əˈsju:m] 美 [əˈsum] v.假定，认为; 承担; 装出; 呈现;

Running QtCar

WARNING: This runs the Tesla services in a chroot with root permissions. This could **mess** up your system since it has root access to a good **chunk** of /dev and /proc.

softool.cn Notes:
mess 英 [mes] 美 [mɛs] n.混乱; 食堂; 肮脏; 困境;vt.弄脏; 搞砸; 给…供膳;vi.把事情弄糟; 制造脏乱;
chunk 英 [tʃʌŋk] 美 [tʃʌŋk] n.厚厚的一块; （某物）相当大的数量或部分; 强壮、结实的马;

# add the IP addresses to localhost
sudo ip addr add 192.168.90.0/24 dev lo

# start the background services in tmux
sudo ./start_car.sh

# figure out what device is your touchscreen
sudo evtest

# start the car computer
sudo ./chroot.sh bash
su -c '/usr/tesla/UI/RunQtCar cid --touch evdev:/dev/input/event9 --window 1 --no-map' -s /bin/bash tesla

Modes

These are all the special modes I’ve found in the Model 3 UI.

Diagnostic Mode

Enabled by setting GUI_diagnosticMode to true.

The only thing it seems to do is to show some of the hidden alerts that are normally hidden from the driver.

TDS Mode

Enabled by setting GUI_tdsMode to true.

This enables the diagnostic app as well as shows the alerts from diagnostic mode. You can open and close the diagnostic app by pressing the Tesla logo.

The diagnostic app data viewer. This has stats from all the various car systems.

Stats from the DAS.

This screen shows stats from the CAN bus messages. You can interactively select which stats you want to be able to view.

The various diagnostic actions.

Some internal settings. Top speed and park assist are possibly from before speed limit mode and ultrasonic sensor parking assists were added to the standard UI.

Apps

Developer Mode

Enabled by setting GUI_developerMode to true.

It shows all of the alerts on the car even those hidden to diagnostics mode.

Pressing the Tesla logo throws an error in the console about trying to open the diagnostics app but it being disabled. Enabling GUI_tdsMode with GUI_developerMode shows some new tabs.

The factory mode overrides change GUI_torqueLimitRequest (default 63) and GUI_powerLimitRequest (default 31).

I’m not sure exactly what setting the torque limit to 6500 Nm means when the car is listed as having 750 Nm of total torque.

Factory Summon

Factory summon seems to be a special form of summon just used in the factory.

softool.cn Notes:
Summon 英 [ˈsʌmən] 美 [ˈsʌmən] vt.传唤，召唤; 鼓起（勇气）; 传讯（出庭）; [军]劲降，招降;

Here’s all the data values related to it:

GUI_factorySmartSummonEnable,false
GUI_factorySmartSummonStart,false
GUI_factorySummonConveyor,false
GUI_factorySummonHeartbeat,0
DAS_factoryGoalLat,0.000
DAS_factoryGoalLong,0.000
DAS_factorySummonStatus,UnavailableNoQRInstruction

SummonConveyor seems to imply they’re using it as a virtual “conveyor belt” in the factory. It seems likely once the drive train is in the car they have the car drive itself down the factory line. UnavailableNoQRInstruction implies that the DAS system is using the cameras on the car to read QR codes that tell the car where to go and they navigate there using smart summon + GPS coordinates.

It would be super cool if they actually use smart summon in the factory and probably makes a lot of sense given QR codes are a lot easier to setup than a conveyor belt.

Enabled by setting GUI_dasDebugOn and GUI_dasDevMode to true.

This didn’t have any obvious effects. It didn’t seem to do anything when I enabled it. The Autopilot tab in the settings is broken in the chroot and when I tried enabling it on my car there wasn’t anything notable either. Possibly you need the car to have FSD enabled for the debug mode to show up?

Enabled by setting GUI_gameDeveloperMode to true.

This doesn’t have any obvious effects. Possibly enables USB debugging or debug data from the games? I didn’t dig too deep into it.

Factory Mode

Enabled by setting GUI_factoryMode to true.

By itself it doesn’t seem to do much. Enabling GUI_tdsMode and GUI_developerMode shows a new “Factory” tab with some more options (see the Developer Mode section).

Service Mode

Enabled by setting GUI_serviceMode to true.

Service Mode is what Tesla Service centers and authorized body shops put your car into when it’s being worked on. It adds a ~3 mph speed limit, disables remote access and disables the dash cams. It also allows for certain operations such as redeploying the firmware after replacing hardware.

Transport Mode

Enabled by setting GUI_transportMode to true.

This mode is pretty minor. I believe it limits the speed the car can drive. It might also make the car sleep/conserve battery. There’s no obvious UI changes.

Showroom Mode

Enabled by setting GUI_showroomMode to true.

No obvious UI changes. Cars in Tesla showrooms have this mode set. It keeps the car awake and disables certain options such as Pin to Drive.

Dynotest Mode

You can enter it by entering dynotest into the text box that appears after long pressing the Tesla logo. Setting GUI_dynotestMode to true didn’t seem to enable it.

This disables traction control for use with dyno testing.

Performance Demo Mode

Enabled by setting GUI_performanceDemoMode to true.

This doesn’t seem to do anything on the Model 3. Possibly this is a ludicrous demo for the Model S.

来源:
https://fn.lc/post/tesla-model-3-modes/