Tesla Instrument Cluster (IC) Center Display (CID/MCU) Retrofit

[amzoo]

I'm currently trying to figure out if it would be possible to run the Tesla instrument cluster and center display in a EV conversion. I was planning to make my own with a Jetson Nano (~$40), 12.3" LCD (~$120), 16-17" touchscreen (~$200), CAN bus peripherals, and cooling. I'd be into it for under $400 if I didn't blow anything up on the first run.

Realized the Tesla S IC (~$200) runs a Tegra 2, the MCU (~$700-1000) runs a Tegra 3, integrated cooling, power, and comm buses. While the MCU is way overkill for my needs, the IC would be ideal for getting the main digital dash features that I would need. Could add the massive touchscreen later.

wk057 successfully ran Doom on the Tesla IC (Likely by X11)
And the one and only Damien got started with this some time ago: Hacking the Tesla MCU/IC

Wondering if anyone here has tried or knows any more than I do regarding reusing these components in another build. I'm okay with either staying with the Tesla firmware and performing injections (like the Tinkla Buddy) but would rather create my own visual elements and run it on the IC directly.

Any development on this I would leave completely open source and share with others on how to use it in their builds

[collin80]

The short answer is: sure you can.

Both the instrument cluster and CID are linux machines. If you "root" the CID you can put whatever you want on there and do whatever you want. If you dump the contents of the memory you can see all their scripts and stuff and modify as appropriate. Now, they don't go out of their way to make this easy on you. But, especially for MCU1 Model S systems it's possible. It gets more difficult as you get into MCU3 Model 3 systems.

Tesla used Embedded QT for the display, you can too. I don't remember if there is an open source version of Embedded QT but there certainly is an open source linux version.

[amzoo]

Perfect, thanks! Was planning on sticking with the MCU1.

I might try to decompile and recompile the original linux kernel. Another user suggested going deeper and going the buildroot/yocto route to start fresh. A lot of this is to stretch my reverse engineering knowledge.

Weirdly I'm getting mixed answers regarding the IC CAN lines. Half say the IC has a CAN transceiver, the other half say it's only there to send the signals over ethernet to the CID. I'm hoping you know better.

[Jack Bauer]

Yeah I have one of these sitting on the shelf mocking me the past while. Sure would be nice not to have to start from scratch:)

[amzoo]

I think there's enough here for me to get started. Off to the dismantlers I go.

Pen Test Partners detail the comm connections as ethernet only to the ID. Still not sure why there are CAN pins on the Tesla wiring diagram though. I'll crack it open and figure out where they lead.

Pen Test Partners ID/CID Hardware
Pen Test Partners ID/CID Firmware

[amzoo]

Leaving some helpful repos here
https://github.com/lunars/tesla
https://github.com/Lunars/freedomev
https://github.com/Lunars/nikola

[amzoo]

MCU1: Nvidia Tegra : Model S and Model X before March 2018
MCU2: Intel Atom E8000 : S/X after March 2018, all Model 3

Connectors:
(X861 - X860) Fakra HSD Ethernet IC to CID:Amphenol 095FPZFJZSG-012

(X434) 18pin IC: AMP 1355348-1
(X434) 18pin IC shield: AMP 1-1355350-1
(X434) Crimp pins: AMP 928999-1

(X429) GPIO/CAN CID: Molex 34729-0201
(X429) Crimp pins: Molex 0348033212

Would be easy enough to cut a Fakra cable in half and crimp the RJ45 on for debugging.
Fakra HSD to RJ45: Pre-made Cable

[amzoo]

Slogged through 1757 posts on the original TMC forum to pull out any relevant info. I need a drink. Nothing here is tested by me (yet).

Power requirements (13.8 V)
Screen Brightness (both screens on):
0% - 3A
50% - 3.7A
100% - 4.5A

Firmware not individually signed per module

MCU1 prior to 2019.4 is rootable

Connect to IC port of MCU should be able to ping the MCU (192.168.90.100) and gateway (192.168.90.102)

Change IC Screens:

Code: Select all

curl -s -m 10 "http://ic:4130/setWindows?left=3&right=4"

Wake up the CID screen

Code: Select all

curl -sL "http://192.168.90.100:4070/_data_set_value_request_?name=CD_displayState&value=2"

Replacing EMMC in MCU

Don't need to IC connected to ethernet for the CID to boot
The maps actually reside on a microSD card on the CID and are shared via NFS with the IC
Once the IC is up, it will stay up even if CID is disconnected

[amzoo]

There used to be a good unofficial tesla tech site that has since been taken down, can be accessed here

eMMC reading, root, firmware backup/upgrading (all require attaching leads to the eMMC on the VMC or desoldering the eMMC directly)

Looking into software solution before going modchip route


MCU1 Disassembly Timelapse

[Markos]

I was wondering if there is any progress with these displays, it would be very interesting if these could be used.

[collin80]

I was wondering if there is any progress with these displays, it would be very interesting if these could be used.

The answer is still the same basically. Both the IC and CID are linux computers. They use TEGRA processors which are ARM. So, you run linux ARM executables on them. Once you get to the point that you can log into the things and obtain root you can use them just like any other computer with a touch screen. The CID has a CAN gateway on it that can send CAN frames for you (it's connected to the rest of the system via ethernet so you send commands to it over IP).

But, the big hurdle is still how to root them. Depending on the software version the CID is running this might either be somewhat easy and straight forward or practically impossible.

I'm not aware of anyone really using these things for non-Tesla stuff - at least not publicly. The hurdles are kind of high and really for the most part you can just get a raspberry pi 4 and a big touch screen and save yourself a LOT of hassle. You can put CAN hats on an RPi4 and be most of the way there - fast computer, monitor, lots of ram and storage, CAN, ethernet. And, the RPI4 will happily let you have root and put anything you want on it.