I drove over to the west coast of Florida to visit my friend from way back in High School and visit the Tesla Sarasota showroom. Like two others I've visited here, it's in a shopping mall.
For a Monday, there were a lot of people in the mall and a steady stream of potential customers coming in and looking at the chassis and assembled car.
Sadly, no pictures. I'm pretty sure at this point my camera is deleting pictures behind my back...
Monday, October 19, 2015
Tesla Tampa Florida Showroom and Service Center
Continuing my trip, I visited the Tampa showroom and service center. Despite the hints on the Tesla web page, this location is very hard to find. It's in a complex of one-story professional and light industrial offices.
Once inside though I was happy to meet with Agnes, a transplanted Scot who talked with me for a long time about her showroom, service center and Tesla in Florida. You can just barely see the service center through the glass doors.
Once inside though I was happy to meet with Agnes, a transplanted Scot who talked with me for a long time about her showroom, service center and Tesla in Florida. You can just barely see the service center through the glass doors.
Monday, October 12, 2015
Tesla Miami Dadeland Florida Showroom
The end of the long day brought us to the Miami Dadeland Tesla showroom. The showroom in Miami beach I went to last year is no more, it was getting more tourists than folks actually in the market for the car, so this site was opened.
As with the Boca Raton showroom, this one is in a mall. There were less people in the mall here this afternoon for some reason.
Sorry, again no pictures.
As with the Boca Raton showroom, this one is in a mall. There were less people in the mall here this afternoon for some reason.
Sorry, again no pictures.
Tesla Dania Beach Florida Showroom and Service Center
We then drove south to the Dania Beach showroom & service center which is just a little bit north of Fort Lauderdale.
There we met Franklin, a very enthusiastic young man! He invited us for a test drive in a Ludicrous mode car, which has just been released and I was not going to pass up on this opportunity. We did 3 passes up and down the service road next to the airport runway. The acceleration is mind-blowing. I didn't have the courage to keep my foot on the floor until the third run. Big thanks to Franklin and best of luck to him in the future.
With my body buzzing with adrenaline, I completely forgot to get any pictures!
There we met Franklin, a very enthusiastic young man! He invited us for a test drive in a Ludicrous mode car, which has just been released and I was not going to pass up on this opportunity. We did 3 passes up and down the service road next to the airport runway. The acceleration is mind-blowing. I didn't have the courage to keep my foot on the floor until the third run. Big thanks to Franklin and best of luck to him in the future.
With my body buzzing with adrenaline, I completely forgot to get any pictures!
Tesla Boca Raton Florida Showroom
Continuing south, we stopped in at the Town Center mall in Boca Raton, home of the Tesla showroom. There were so many people walking into the store that I only had time for a brief chat with Dan. Shopping malls are a good way to get eyes on the car and plant a seed in people's minds.
Charging stations in the mall parking lot.
Charging stations in the mall parking lot.
Tesla West Palm Beach Florida Showroom and Service Center
While I'm in Florida visiting my father, I decided to visit all of the Tesla showrooms in South Florida. Heading south from Vero Beach, first up was West Palm Beach.
This location is a bit out of the way but quite a large facility with a showroom and service facility. I spoke with Steve and Tess. We talked about the launch of the Model X and Tesla in general. Tesla is doing quite well in south Florida and they expect the trend to accelerate.
This location is a bit out of the way but quite a large facility with a showroom and service facility. I spoke with Steve and Tess. We talked about the launch of the Model X and Tesla in general. Tesla is doing quite well in south Florida and they expect the trend to accelerate.
Saturday, October 3, 2015
EVCCON 2015 - Day 4
This morning the schedule shows the Car Show at Jack's house from 9 AM - 2 PM. For the majority of us, it meant a well-deserved sleep-in and then hang out in the workshop until 2 PM.
Ray and Nabil got their motorbike-of-death running. It's a frankenbike made with a Kelly controller and an automotive alternator wired backwards.
Among the goodies found around the shop was this Chinese motor controller from a company called Shinry. Yes, the jokes just write themselves folks. The specs seem good, liquid cooled and even includes a DC-DC converter so if it tests out well it could be a viable controller.
This is a section of Tesla battery pack, made from 18650 form-factor Lithium Ion batteries. Every one of those holes is a battery and there's a tiny wire welded from the battery to the metal backplate, acting like a fuse. If a battery goes runaway, the wire will melt and the battery will be taken out of the circuit in the pack.
This is the guts of a 10 KW Tesla battery charger. Time will tell if Jack and the team can reverse engineer it and install it into a vehicle.
At 2 PM, Jack kicked off the awards. This year, the awards are small and engraved plastic rather than the huge softball-championship-trophies in years past.
Awards were given for the top 3 attending cars but the drag strip and autocross trophies went un-awarded as those events were cancelled this year.
Steve West and Nick Smith and their Charge.net.nz organization won the Electric Vehicle Evangelist of the Year award, well-deserved.
Kevin Smith, leader of the Illuminati Motor Works team that came *this* close to winning the Progressive Automotive X Prize, won for Technical Innovation.
Second year in a row, I snagged the Furthest Travelled Attendee, or as Jack called it this year, "Global Visionary (Furtherest Travelator). Nick Smith went the long way around through the UK to try to beat me, but my 3 months on the road from door to door added up to 27,418 miles, longer than the earth is around. He'll have to step up his game next year.
After the awards, most of us headed over to Sikeston to Dyno Dom's drag race track. Most years we went on Sunday morning but Jack decided to go on Saturday night this year. The dinosaur-juice folks were out in force, while we made up a small EV contingent, under the official auspices of NEDRA.
After waiting for about an hour and a half in frigid cold and cloudy skies, Dyno Dom cancelled the whole day on account of rain which didn't really exist. The lady at the ticket gate refused to give us each our $15 back, but did write on them that we could come back later. We explained we only come once a year but she wouldn't relent. Screwed again...
Most folks headed back to the hotel for free "kickback" drinks and buffet of tremendously fattening American food. I couldn't get anybody interested in going out for the evening so many goodbyes were said. The Drury Lodge is scheduled soon for demolition and rebuild into an 8 storey hotel so we'll have to find a new place to stay next year and possibly the year after that if their schedule slips.
All in all a great week, with the hard-core EVCCON folks showing up despite cancellation and we managed to safely get liquored up and play with high voltage again. Until next year...
Ray and Nabil got their motorbike-of-death running. It's a frankenbike made with a Kelly controller and an automotive alternator wired backwards.
Among the goodies found around the shop was this Chinese motor controller from a company called Shinry. Yes, the jokes just write themselves folks. The specs seem good, liquid cooled and even includes a DC-DC converter so if it tests out well it could be a viable controller.
This is a section of Tesla battery pack, made from 18650 form-factor Lithium Ion batteries. Every one of those holes is a battery and there's a tiny wire welded from the battery to the metal backplate, acting like a fuse. If a battery goes runaway, the wire will melt and the battery will be taken out of the circuit in the pack.
This is the guts of a 10 KW Tesla battery charger. Time will tell if Jack and the team can reverse engineer it and install it into a vehicle.
At 2 PM, Jack kicked off the awards. This year, the awards are small and engraved plastic rather than the huge softball-championship-trophies in years past.
Awards were given for the top 3 attending cars but the drag strip and autocross trophies went un-awarded as those events were cancelled this year.
Steve West and Nick Smith and their Charge.net.nz organization won the Electric Vehicle Evangelist of the Year award, well-deserved.
Kevin Smith, leader of the Illuminati Motor Works team that came *this* close to winning the Progressive Automotive X Prize, won for Technical Innovation.
Second year in a row, I snagged the Furthest Travelled Attendee, or as Jack called it this year, "Global Visionary (Furtherest Travelator). Nick Smith went the long way around through the UK to try to beat me, but my 3 months on the road from door to door added up to 27,418 miles, longer than the earth is around. He'll have to step up his game next year.
After the awards, most of us headed over to Sikeston to Dyno Dom's drag race track. Most years we went on Sunday morning but Jack decided to go on Saturday night this year. The dinosaur-juice folks were out in force, while we made up a small EV contingent, under the official auspices of NEDRA.
After waiting for about an hour and a half in frigid cold and cloudy skies, Dyno Dom cancelled the whole day on account of rain which didn't really exist. The lady at the ticket gate refused to give us each our $15 back, but did write on them that we could come back later. We explained we only come once a year but she wouldn't relent. Screwed again...
Most folks headed back to the hotel for free "kickback" drinks and buffet of tremendously fattening American food. I couldn't get anybody interested in going out for the evening so many goodbyes were said. The Drury Lodge is scheduled soon for demolition and rebuild into an 8 storey hotel so we'll have to find a new place to stay next year and possibly the year after that if their schedule slips.
All in all a great week, with the hard-core EVCCON folks showing up despite cancellation and we managed to safely get liquored up and play with high voltage again. Until next year...
Friday, October 2, 2015
EVCCON 2015 - Day 3
Session: Arduino CAN_DUE Library Advanced Techniques - Collin Kidder
Collin's CAN_DUE library brings advanced CANbus handling functionality to the Arduino world. All code written by the extended EVTV coding teams uses CAN_DUE.
The hardware has 8 "mailboxes" which can be used to send or receive data on the CANbus, and everything is interrupt driven using callback function registration, which is far more efficient than polling, although polling is available.
There are two independent CANbuses, you can run both independently at the same time.
To initialize a CANbus, use the begin() method call with the desired bus speed and the hardware pin connected to the bus. You can also later adjust the bus speed.
Filtering of incoming messages is set using a number of method calls where you specify which message frame ids you're interested in.
The main data structure is called CAN_FRAME and contains all of the critical information about each incoming and outgoing message, including the message id and data. A union data structure allows you to access the data by low and high int, four shorts or 8 bytes without casting and converting each time.
Sending data is done with the sendFrame() method call, passing in your formatted CAN_FRAME.
One thing to remember is that although Arduino sketches look like C++ code, it's not a full implementation. For instance, you cannot use a C++ class' method as a callback target.
Very powerful CANbus apps can be written in very few lines of code thanks to this library. Great work Collin!
News Flash: Charge.net.nz has announced that BMW wants to sponsor their fast charging network effort in New Zealand with €200,000!
Session: CHAdeMO Fast Charging Standard – Collin Kidder and Jack Rickard
Jack has decided to build a car-side CHAdeMO charging solution. This can be fitted into any electric vehicle to provide fast-charging, slashing charging time and enabling long-distance driving by reducing range anxiety and objections over long charging times.
The expensive part of the kit is the CHAdeMO connector at about $900. All that's needed in addition is two high-voltage, high-current contactors, a small automotive relay and the EVTV-developed JLD505 meter & CANbus controller, but this may be replaced by a GEVCU in the future.
The CHAdeMO specification lists output at 50V - 500V DC, but real-world testing shows some manufacturers are cheating on the spec by ignoring lower voltages in the range. Usable range is about 250V - 500V which excludes most DC-motor enabled cars. While this works for so-far every OEM manufactured car, a lot of home conversions will not be able to benefit from this.
Tesla appears to use the CHAdeMO protocol under the covers, running on 33.3kbps single wire CANbus. They read the vehicle VIN number and only function when the VIN is validated against known Tesla vehicles.
Contrary to what most people would think, the car is in full control of the charging process. The car requests initiation of charge, requests current and voltage levels and later requests termination of charge. The car requests gradual increases and decreases in current at the start and end of the charge cycle. The charger is supposed to follow these commands.
EVTV testing has shown a variety of behaviours from different manufacturers. I wish that the CHAdeMO standards body would enforce all aspects of the spec. At this relatively initial point in the rollout of CHAdeMO around the world, now is the time to get all devices in full compliance. What we need is a Networld/Interop of chargers and cars. Idaho National Labs has apparently hosted something like this and reported that everything is just fine, but we know that's not true. From this paper from a couple of months ago it appears they only tested J1772 devices, not CHAdeMO.
Here is the list of Certified CHAdeMO chargers. Note Blink is not on the list.
Session: Recording Battery Voltages into Excel using Voice Recognition - Al Gadja
Every Windows PC has speech recognition built in. Control Panel -> Sound -> Recording -> Configure. You can train the computer to better understand your voice.
He uses a $15-$20 headset with a microphone boom. Speak naturally and let the computer lag a bit behind.
As he goes down the battery pack, he speaks the voltages followed by the word "newline".
Eg. 3.125 newline 3.129 newline 3.1209 newline.
Al has an Excel spreadsheet template that applies colors to different cell voltages and graphs charged, discharged and difference values for each cell in the pack. This allows you to easily visualize the state of health of each battery, with the outliers clearly indicated in the graphs.
Session: Ladder Logic and Vehicle PLC Controllers - Al Gadja
PLCs are Programmable Logic Controllers, long used in industry to control any electrical or mechanical device. Ladder Logic is a visual representation of the flow of control of the program. You read the logic left to right. You can place different device types in the ladder, set preferences and then draw lines. When complete, you can run it in Simulation mode to see how the logic will work when installed into a PLC and run in the target device.
Everything in his Dodge Brothers truck is controlled through the PLC - nothing is directly wired. It's from the Crouzet company and cost about $575 for the PLC, relay board and power supply. It has 26 digital input ports and 26 replay output ports rated at 8A and 250V.
Session: Azure Dynamics eTransit Connect/heaters/AC/CAN - Byron Izbenhaard
Byron bought this van, has done two road trips and has put 2,000 miles on it. He bought it for $6,500 from a Ford dealer who had no idea how to fix it, and had a lot of wrong ideas. It turns out both battery pack interlocks were pulled out, and the Pre-Charge was not finishing. Once he fixed that, the vehicle was running again. One remaining issue was the heating unit was bad. The coolant channels were full of goo and the electronics board was corroded.
He has changed to Evans Waterless coolant and a new heating unit from Eberspächer, taken from a Chevy Volt, about 1/3 the size of the original and about the same power level of 6.6 KW. He made up a mounting bracket and attached it to the original heater location. He made up a new hose set with transitions to the van's larger piping.
He then did a characterization of a new thermistor using an oven and determined the difference between the original one and the new one. The solution was to add an 820 ohm resistor in series with the thermistor to get very close to the original profile.
The next challenge is to get an EVTV CANDue 2.0 board and software working to correctly drive the unit's heating capabilities. After some trial and tribulation, the heater worked on the test bench. Luckily the van already has 4 heater level CANbus messages in the diagnostic software, so he sniffed the bus with SavvyCAN to find the messages and used those to flash new firmware and drive the unit. Byron mounted it in the van and it's working quite well. The heating is controlled with the original dashboard controls, keeping the stock look and feel and avoiding the out-of-place looking switches that we sometimes find in EV conversions.
Session: CANdo Battery Temperature Sensor - Nabil Henke and Ray Schaffler
There is a growing need for CANbus-based single-function devices. After a problem with a thermal switch, Nabil and Ray have come up with a system that reads temperature and broadcasts the values across the CANbus.
It consists of a 2" x 2" x 1/2" white plastic module and up to 7 temperature sensor inputs. It can also directly control Elcon / Chennic chargers. Using a Bluetooth serial port configuration, you can install multiple modules in a car. If any of the temperatures are too cold, it will inhibit the charger from starting. Hooking up to a serial terminal port, you must set your charger target voltage and current in 1/10th of a volt, i.e. 124.5V = 1245. It is fixed at 250kbs and Extended Addressing to match the Elcon charger but they're open to a firmware update to allow for baud rate changing. They are available for $120 including 4 temperature sensors, and additional sensors cost $10 each. Jack will have them in the evtv.me store when they can give him sufficient quantity.
Session: Building The Little Lightn!ng Bike - Nabil Henke and Ray Schaffler
Last year they brought a 3 wheel bike called Banshee. The students they mentor decided to do two 2-wheel bikes called Grease and Lightn!ng and things went downhill from there. It's primary motor is an automotive alternator and uses a 48V / 10AH battery pack, built by spot-welding 18650 cells. The cheap Kelly controller they used needs 3 Hall Effect sensors which were a pain to get working. They used the 12-pole magnet ring from a CD-ROM drive.
Nabil and Ray are members of the Area 515 Maker Space in Des Moines, Iowa.
BBQ At Jack's House
We all headed down to Jack's house, overlooking the Mississippi river, for the first no-rain BBQ in EVCCON history.
Collin's CAN_DUE library brings advanced CANbus handling functionality to the Arduino world. All code written by the extended EVTV coding teams uses CAN_DUE.
The hardware has 8 "mailboxes" which can be used to send or receive data on the CANbus, and everything is interrupt driven using callback function registration, which is far more efficient than polling, although polling is available.
There are two independent CANbuses, you can run both independently at the same time.
To initialize a CANbus, use the begin() method call with the desired bus speed and the hardware pin connected to the bus. You can also later adjust the bus speed.
Filtering of incoming messages is set using a number of method calls where you specify which message frame ids you're interested in.
The main data structure is called CAN_FRAME and contains all of the critical information about each incoming and outgoing message, including the message id and data. A union data structure allows you to access the data by low and high int, four shorts or 8 bytes without casting and converting each time.
Sending data is done with the sendFrame() method call, passing in your formatted CAN_FRAME.
One thing to remember is that although Arduino sketches look like C++ code, it's not a full implementation. For instance, you cannot use a C++ class' method as a callback target.
Very powerful CANbus apps can be written in very few lines of code thanks to this library. Great work Collin!
News Flash: Charge.net.nz has announced that BMW wants to sponsor their fast charging network effort in New Zealand with €200,000!
Session: CHAdeMO Fast Charging Standard – Collin Kidder and Jack Rickard
Jack has decided to build a car-side CHAdeMO charging solution. This can be fitted into any electric vehicle to provide fast-charging, slashing charging time and enabling long-distance driving by reducing range anxiety and objections over long charging times.
The expensive part of the kit is the CHAdeMO connector at about $900. All that's needed in addition is two high-voltage, high-current contactors, a small automotive relay and the EVTV-developed JLD505 meter & CANbus controller, but this may be replaced by a GEVCU in the future.
The CHAdeMO specification lists output at 50V - 500V DC, but real-world testing shows some manufacturers are cheating on the spec by ignoring lower voltages in the range. Usable range is about 250V - 500V which excludes most DC-motor enabled cars. While this works for so-far every OEM manufactured car, a lot of home conversions will not be able to benefit from this.
Tesla appears to use the CHAdeMO protocol under the covers, running on 33.3kbps single wire CANbus. They read the vehicle VIN number and only function when the VIN is validated against known Tesla vehicles.
Contrary to what most people would think, the car is in full control of the charging process. The car requests initiation of charge, requests current and voltage levels and later requests termination of charge. The car requests gradual increases and decreases in current at the start and end of the charge cycle. The charger is supposed to follow these commands.
EVTV testing has shown a variety of behaviours from different manufacturers. I wish that the CHAdeMO standards body would enforce all aspects of the spec. At this relatively initial point in the rollout of CHAdeMO around the world, now is the time to get all devices in full compliance. What we need is a Networld/Interop of chargers and cars. Idaho National Labs has apparently hosted something like this and reported that everything is just fine, but we know that's not true. From this paper from a couple of months ago it appears they only tested J1772 devices, not CHAdeMO.
Here is the list of Certified CHAdeMO chargers. Note Blink is not on the list.
Session: Recording Battery Voltages into Excel using Voice Recognition - Al Gadja
Every Windows PC has speech recognition built in. Control Panel -> Sound -> Recording -> Configure. You can train the computer to better understand your voice.
He uses a $15-$20 headset with a microphone boom. Speak naturally and let the computer lag a bit behind.
As he goes down the battery pack, he speaks the voltages followed by the word "newline".
Eg. 3.125 newline 3.129 newline 3.1209 newline.
Al has an Excel spreadsheet template that applies colors to different cell voltages and graphs charged, discharged and difference values for each cell in the pack. This allows you to easily visualize the state of health of each battery, with the outliers clearly indicated in the graphs.
Session: Ladder Logic and Vehicle PLC Controllers - Al Gadja
PLCs are Programmable Logic Controllers, long used in industry to control any electrical or mechanical device. Ladder Logic is a visual representation of the flow of control of the program. You read the logic left to right. You can place different device types in the ladder, set preferences and then draw lines. When complete, you can run it in Simulation mode to see how the logic will work when installed into a PLC and run in the target device.
Everything in his Dodge Brothers truck is controlled through the PLC - nothing is directly wired. It's from the Crouzet company and cost about $575 for the PLC, relay board and power supply. It has 26 digital input ports and 26 replay output ports rated at 8A and 250V.
Session: Azure Dynamics eTransit Connect/heaters/AC/CAN - Byron Izbenhaard
Byron bought this van, has done two road trips and has put 2,000 miles on it. He bought it for $6,500 from a Ford dealer who had no idea how to fix it, and had a lot of wrong ideas. It turns out both battery pack interlocks were pulled out, and the Pre-Charge was not finishing. Once he fixed that, the vehicle was running again. One remaining issue was the heating unit was bad. The coolant channels were full of goo and the electronics board was corroded.
He has changed to Evans Waterless coolant and a new heating unit from Eberspächer, taken from a Chevy Volt, about 1/3 the size of the original and about the same power level of 6.6 KW. He made up a mounting bracket and attached it to the original heater location. He made up a new hose set with transitions to the van's larger piping.
He then did a characterization of a new thermistor using an oven and determined the difference between the original one and the new one. The solution was to add an 820 ohm resistor in series with the thermistor to get very close to the original profile.
The next challenge is to get an EVTV CANDue 2.0 board and software working to correctly drive the unit's heating capabilities. After some trial and tribulation, the heater worked on the test bench. Luckily the van already has 4 heater level CANbus messages in the diagnostic software, so he sniffed the bus with SavvyCAN to find the messages and used those to flash new firmware and drive the unit. Byron mounted it in the van and it's working quite well. The heating is controlled with the original dashboard controls, keeping the stock look and feel and avoiding the out-of-place looking switches that we sometimes find in EV conversions.
Session: CANdo Battery Temperature Sensor - Nabil Henke and Ray Schaffler
There is a growing need for CANbus-based single-function devices. After a problem with a thermal switch, Nabil and Ray have come up with a system that reads temperature and broadcasts the values across the CANbus.
It consists of a 2" x 2" x 1/2" white plastic module and up to 7 temperature sensor inputs. It can also directly control Elcon / Chennic chargers. Using a Bluetooth serial port configuration, you can install multiple modules in a car. If any of the temperatures are too cold, it will inhibit the charger from starting. Hooking up to a serial terminal port, you must set your charger target voltage and current in 1/10th of a volt, i.e. 124.5V = 1245. It is fixed at 250kbs and Extended Addressing to match the Elcon charger but they're open to a firmware update to allow for baud rate changing. They are available for $120 including 4 temperature sensors, and additional sensors cost $10 each. Jack will have them in the evtv.me store when they can give him sufficient quantity.
Session: Building The Little Lightn!ng Bike - Nabil Henke and Ray Schaffler
Last year they brought a 3 wheel bike called Banshee. The students they mentor decided to do two 2-wheel bikes called Grease and Lightn!ng and things went downhill from there. It's primary motor is an automotive alternator and uses a 48V / 10AH battery pack, built by spot-welding 18650 cells. The cheap Kelly controller they used needs 3 Hall Effect sensors which were a pain to get working. They used the 12-pole magnet ring from a CD-ROM drive.
Nabil and Ray are members of the Area 515 Maker Space in Des Moines, Iowa.
BBQ At Jack's House
We all headed down to Jack's house, overlooking the Mississippi river, for the first no-rain BBQ in EVCCON history.
Thursday, October 1, 2015
EVCCON 2015 - Day 2
Session: John Hardy - Battery Testing
Day 2 kicked off, surprisingly on time, with John Hardy from the UK. John returns again as our overseas battery testing expert. He reviewed his earlier battery testing methodology and cell types.
The Headway 38120S cell had no detectable voltage drift but the first cell failed after 600 discharge / charge cycles.
He tested a shunt balancing product which simply destroyed the pack in under 100 cycles. He is a fan of bottom-balancing your pack before assembly.
His CALB CA40fi cells lived beyond 2000 charging cycles and each of the 8 cells showed nearly identical voltage profile on the 2000th cycle, which is exactly what we want in our batteries.
John's full testing history shows that Lithium Ion batteries have no discernable drift and an extremely long charging cycle life.
John then moved to his current (no pun intended) testing of the Tesla-style 18650 LiFePO4 cells. He has developed a new charging algorithm so has asked us to not talk about his ideas until they're protected. I will say it's very sophisticated and looks very good! Hoping to hear good things in the future.
Session: Collin Kidder – CAN Bus Hacking Hardware And Software
Collin's work writing software to collect and analyze CANbus traffic of existing OEM automotive components has formed the cornerstone of the reverse-engineering innovation of the world-wide EVTV team. Due to his efforts we now can control the charger and DC-DC converters from Chevy Volts, the motor and controller for UQM/Coda vehicles, the motor and controller from Siemens/Azure Dynamics DMOC and the motor and controller from the Tesla Model S.
Collin recommends the EVTV CANDue 2.0 board as it has two complete isolated 2-wire and 1-wire CANbus connections, a temperature sensor, a MicroSD memory card slot for massive data logging and a 256kb EEPROM for persistent data storage. It is a standard Arduino shield, meant to be stacked on top of a standard Arduino Due processor board.
Another option is the EVTV Due board, which combines the features of an Arduino Due and a CANDue 2.0, but does not have a 1-wire CANbus port. It has a much stronger USB port and screw terminals for power and CANbus wiring.
Jack has developed a plug-and-play device in a box to plug directly into a Tesla Model S diagnostic port which is native CANbus and Tesla cannot disable it.
GVRET is Collin's CANbus sniffing tool, driving the hardware to capture all CANbus traffic. It is Arduino firmware and is flashed into one of the above boards.
SavvyCAN is a QT5-based app which is used to analyze the CANbus data captured by the hardware and GVRET. QT5 supports Windows, Linux and MacOS. It has sophisticated tools to visualize and filter messages and can also play back messages onto a live CANbus. This is critical to fast development of an independent controller for an OEM CANbus device with no manufacturer documentation.
DBC files are used to define signals that flow on a CANbus. As you reverse-engineer a device, DBC files save the knowledge gained and help SavvyCAN interpret the format of specific messages.
The reverse-engineering process is as follows:
- Find a convenient place to plug into the CANbus.
- Capture some bus traffic to see if it's working
- Go for a drive and capture real bus traffic
- Perform small discrete functions and save the traffic into separate small files, such as open the door lock, close the door lock, shift into neutral, press the brake pedal, etc.
- Launch SavvyCAN and isolate the meaningful messages
- Define newly discovered messages in a DBC file
- Play captured or synthesized messages back on the bus and see what happens
- Write software in a controller to perform that specific function.
Note that this is *not* easy and you will get better at message analysis as you see more devices and more ways of representing data.
Collin gave us a guided tour of SavvyCAN. There are many, many ways to visualize the data to help you find patterns and values leading to your solution.
We have to break for lunch, Collin will continue again later this afternoon.
Session: Craig Smith - Car Hacker's Handbook 2014. – Politics and Legal Environment of Automotive Security
Now we're packing up to go to the BBQ at Jack's house. It looks like this will be the first year we don't get rained out.
Day 2 kicked off, surprisingly on time, with John Hardy from the UK. John returns again as our overseas battery testing expert. He reviewed his earlier battery testing methodology and cell types.
The Headway 38120S cell had no detectable voltage drift but the first cell failed after 600 discharge / charge cycles.
He tested a shunt balancing product which simply destroyed the pack in under 100 cycles. He is a fan of bottom-balancing your pack before assembly.
His CALB CA40fi cells lived beyond 2000 charging cycles and each of the 8 cells showed nearly identical voltage profile on the 2000th cycle, which is exactly what we want in our batteries.
John's full testing history shows that Lithium Ion batteries have no discernable drift and an extremely long charging cycle life.
John then moved to his current (no pun intended) testing of the Tesla-style 18650 LiFePO4 cells. He has developed a new charging algorithm so has asked us to not talk about his ideas until they're protected. I will say it's very sophisticated and looks very good! Hoping to hear good things in the future.
Session: Collin Kidder – CAN Bus Hacking Hardware And Software
Collin's work writing software to collect and analyze CANbus traffic of existing OEM automotive components has formed the cornerstone of the reverse-engineering innovation of the world-wide EVTV team. Due to his efforts we now can control the charger and DC-DC converters from Chevy Volts, the motor and controller for UQM/Coda vehicles, the motor and controller from Siemens/Azure Dynamics DMOC and the motor and controller from the Tesla Model S.
Collin recommends the EVTV CANDue 2.0 board as it has two complete isolated 2-wire and 1-wire CANbus connections, a temperature sensor, a MicroSD memory card slot for massive data logging and a 256kb EEPROM for persistent data storage. It is a standard Arduino shield, meant to be stacked on top of a standard Arduino Due processor board.
Another option is the EVTV Due board, which combines the features of an Arduino Due and a CANDue 2.0, but does not have a 1-wire CANbus port. It has a much stronger USB port and screw terminals for power and CANbus wiring.
Jack has developed a plug-and-play device in a box to plug directly into a Tesla Model S diagnostic port which is native CANbus and Tesla cannot disable it.
GVRET is Collin's CANbus sniffing tool, driving the hardware to capture all CANbus traffic. It is Arduino firmware and is flashed into one of the above boards.
SavvyCAN is a QT5-based app which is used to analyze the CANbus data captured by the hardware and GVRET. QT5 supports Windows, Linux and MacOS. It has sophisticated tools to visualize and filter messages and can also play back messages onto a live CANbus. This is critical to fast development of an independent controller for an OEM CANbus device with no manufacturer documentation.
DBC files are used to define signals that flow on a CANbus. As you reverse-engineer a device, DBC files save the knowledge gained and help SavvyCAN interpret the format of specific messages.
The reverse-engineering process is as follows:
- Find a convenient place to plug into the CANbus.
- Capture some bus traffic to see if it's working
- Go for a drive and capture real bus traffic
- Perform small discrete functions and save the traffic into separate small files, such as open the door lock, close the door lock, shift into neutral, press the brake pedal, etc.
- Launch SavvyCAN and isolate the meaningful messages
- Define newly discovered messages in a DBC file
- Play captured or synthesized messages back on the bus and see what happens
- Write software in a controller to perform that specific function.
Note that this is *not* easy and you will get better at message analysis as you see more devices and more ways of representing data.
Collin gave us a guided tour of SavvyCAN. There are many, many ways to visualize the data to help you find patterns and values leading to your solution.
We have to break for lunch, Collin will continue again later this afternoon.
Session: Craig Smith - Car Hacker's Handbook 2014. – Politics and Legal Environment of Automotive Security
Next up is Craig Smith, a new EVTV speaker. He's an expert in vehicle computer systems. Cars are basically rolling computer networks. He started out by talking about the current legality of vehicle hacking. He says to always talk about "hardware". We all know software is running inside all of these computers, but in the eyes of the law, it's all hardware. We are already protected in law to reverse engineer components to add 3rd party devices, so the line is blurry.
Who Owns Your Car? GM, John Deere and the Auto Alliance. GM claims they retain copyright on the software inside and we are not allowed to look at it. The basis of their opinion is the DMCA - Digital Millennium Copyright Act - which was originally intended for movie and music piracy. People have proposed new Class 21 and 22 exemptions to DMCA about reverse engineering for security research and the right to understand and update firmware. The Copyright Office has not decided on these two exemption requests yet. We are a small voice against the large corporations and their lobbyists. No one has been sued yet though, and the industry is worried about losing the suit so the only tool they have is threatening people with potential litigation.
What can we do to help? Share information. Share stories. Share data. Collaborate. Check out the Open Garages group and the I Am The Cavalry group.
Craig talked about other CAN sniffing hardware, from $60 open source to $5000 proprietary Kvaser and software such as SocketCAN and the Linux Can-utils package that you match up with them. The LAWICEL protocol is a network protocol under Arduino that handles CANbus traffic like any other network device. There are 3 CAN interfaces: Can0, SIcan0 and Vcan0.
Craig showed a demo that he created. It uses a Playstation controller to drive a virtual car with speedometer, left and right turn signals and door locks via CAN traffic.
There are additional software layers available that run on top of CAN such as UDS that provides higher-level functions such as ECU reset, diagnostic codes, VIN number and data upload and download.
There is an important packed called TesterPresent. It is issued every 2 or 3 seconds and tells the car a diagnostic tool is connected. Some functions may require this.
SecurityAccess tokens are required to update firmware. It's a multi-step handshaking protocol to prevent easy hacking.
Craig showed up pictures of his test bench with a junkyard dashboard and ECU and pots for changing simulated data values such as fuel level and RPM.
We had a good Q&A session to wrap up before Craig had to leave for the airport.
Jack gave Craig an EVTV Due board to see if he can use it in his research. Big thanks to Craig!
More Cars!
Session: Jack Rickard - Tesla Drivetrain Demonstration
We moved into the workshop area where Jack's Tesla drivetrain test bench is located. He showed us the control panel which operates contactors and simulated the brake pedal. He showed us the Arduino code that drives commands to the motor controller, and then he engaged drive and spun the unit up. He demonstrated forward, reverse and neutral and creep mode.
We moved into the workshop area where Jack's Tesla drivetrain test bench is located. He showed us the control panel which operates contactors and simulated the brake pedal. He showed us the Arduino code that drives commands to the motor controller, and then he engaged drive and spun the unit up. He demonstrated forward, reverse and neutral and creep mode.
Here is a short video from his demonstration.
For longer video and a far more detailed description of the reverse engineering of the Tesla drivetrain, please see the relevant EVTV videos here.
For longer video and a far more detailed description of the reverse engineering of the Tesla drivetrain, please see the relevant EVTV videos here.
Now we're packing up to go to the BBQ at Jack's house. It looks like this will be the first year we don't get rained out.
Subscribe to:
Posts (Atom)