Hacking the Prius computers

<div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 03:09 PM) [snapback]470680[/snapback]</div>

YES sweet!. Finally someone I can get along with. :lol: I dont run die hard GNU but I do run linux as my main OS. ya ya, G.N.U. Gnu not unix, ./whatever, your just a cousin

If you find an apache interface for the Pri, I want in on it. I'm not too worried about getting that far into my pri and I really dont wanna screw something up since it is my only car and my daily driver. I'd rather leave it up to someone else to figure it out and I'll just tag along.

 

Two words: Warranty and Liability.

These prevent Toyota from helping you. In addition, you're not talking about one computer, you're dealing with a cluster, all running real-time code. There's an SKS computer, just for lock and unlock capability. ECU for battery, ECU for brakes, ECU for ICE, ECU for HSD... Then there is also the superfluous code that runs the AV LAN and the MFD. Climate control??? VSC??? Traction???

If you search here on PC you can find references to the manufacturers of the ECUs. From there you can probably find the assembler code that controls them. Unix/Linux/Mac OS X/Windows are all very high level abstractions, and none real-time, compared to the low-level code that runs your Prius.

 

I want in on this too!

But I have limited high-level programming ability and don't want to disassemble my dash beyond repair (or even driveability,) since this too is my daily driver (and only car at the moment, until I get the motor shaft on my EV fixed.) However, assembly language is my preference! (I've been programming on the Commodore 64 for YEARS in ML.)

My list of desired tweaks:
1) Use more of the battery (as you state)
2) Adjust regen amount/ramp curve/pedal travel parameters for both brake pedal & accelerator pedal (I can do this in my EV now since I upgraded it with a tweakable inverter. )
3) Change the refresh rate on the energy flow diagram to 0.5s or so. (It's currently 3s according to the manual.)

So my suggestions:
1) Pick up a copy of the repair/service manual and study the dash disassembly sections. (Look in the back page of your Owner's manual. It tells you where to get the Service manual (Dealer or call the toll-free number listed.))
2) Check out TIS, the info system for dealers/servicepeople. You can apparently order one of many J2534 programming tools ($1200~$1600...how seriously do you want to do this?) to flash the system's code for various vendors' cars, and can order a Calibration CD with the Prius code from Toyota. I'm sure it's in some encrypted binary format, so we'll need a seasoned cracker. Aside from that, it at least offers a measure of protection if you screw something up real bad since you can go back to the factory image.

Go to http://techinfo.toyota.com/ then click Vehicle Reprogramming under Valuable Resources.

<div class='quotetop'>QUOTE(Bill Merchant @ Jun 30 2007, 11:53 PM) [snapback]470888[/snapback]</div>

Good! Modularity helps prevent big screwups! Seems we'd only want to mess with the battery, brakes and HSD ECUs. Once we tweak 'em up nice, then we tackle the MFD code to add soft buttons to access the added goodies! Muhahaha...

 

I should have congratulated you on your new car and welcomed you to PriusChat, aeronaut, instead of just jumping right in on an answer of sorts. Congratulations and welcome!

There's a thread on acronyms here. SKS is Smart Key System which is how the fob and the car know each other and communicate. HSD is Hybrid Synergy Drive which is Toyota's name for the collection of technology that is the Prius.

You will probably want to search on here for CAN View, which is a method and equipment to read the low level Controller Area Network. This LAN carries most of the vital communications. You seem to want to play with the AVC-LAN. It touches: Audio Head Unit, MFD Multi Function Display, Navigation ECU, and Gateway ECU. It's the Gateway that connects the various LANs.


<div align="center">[attachmentid=9342] </div>

 

<div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 03:09 PM) [snapback]470680[/snapback]</div>

Welcome! Forgive me if I duplicate some responses, I scanned the rest of the thread quickly, but might have missed some of it:

1. The Prius battery back is much less efficient in the low range of SoC (State of Charge), and the life of the battery would be reduced if it were allowed to run down like that. In terms of both performance and longevity, it would not be a good hack to change those limits. What would be a good hack is to add more batteries, and/or make it plug-in capable.

2. Software... it always has limitations, or bugs, or things you just wish would be different. Have you checked out CAN-view? You sound like a good candidate for purchasing that. Most people don't care about the nitty-gritty, and frankly it would be distracting and dangerous to present them with all the info you want. For the chosen few, there are toys like CAN-view (although I'd still argue in favor of a nice graphical front-end for it).

3. All those funny driving characteristics are there to make people feel safe and comfortable. Your average Joe wants it to drive like your average car, and Toyota is smart to not overstep here. People would flip out if the thing drove like the future car we all want. And some people would undoubtedly crash the car if it had some of the traits you want. I don't know if anyone has successfully modded their car to do that though... I think that's embedded behavior that would be difficult to change without risking some very serious damage to your car.

Fortunately for us, you can still feather the pedal to get a good glide. And it makes you feel like you have some special s00per-sekrit knowledge when you do it too!

Enjoy the car, and if you successfully hack the ECU's, let us know and post tutorials

 

<div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 12:09 PM) [snapback]470680[/snapback]</div>

I guess my immediate comment is that Toyota has not put the Prius' code into the open source community. Absent that happening, you are pretty much reliant on your ability to crack the code. And then if Toyota finds out about the cracking, you have the problem of contending with enforcement actions that Toyota may take to protect their intellectual property. They did after all, put a non-trivial amount of effort into developing the software.

 

Think this through.

If you get past all the hurdles, make your modifications to the accelerator and deaccelerator, then how do you test it? Load the code and head out past the elementary school and then get on the interstate at rush hour? How have you proven your accelerator gain is 5 mph/sec instead of 500 mph/sec? Do you plan on writing a Prius simulation model to validate what you are doing? What safety or shutoff systems are you going to install prior to leaving the test track?

I like curiosity and trying to improve things, but this is big time. I have no problem with it being done right (i.e. no one put at risk) and if your create some expensive repairs in the process then that is the price of learning. .... but a 3000 pound high energy machine is probably not the best place to start learning hacking skills, 500 Volt inverter control, and power plant PID feedback loops.

 

This is top secret stuff here. People have been x'd out for being nosey. You may own your car, but that doesn't mean you own the secrets. If Toyota wanted us to be able to adjust our cars they would have installed a retractable 2.0 usb cord under the dash.

PM if you want to know about the ***THSynDCC***

 

Heh... you expect a web-based management interface into the prius??
Well, while many people have gotten used to embedded widgets with
mini-webservers built in, the prius ain't one of them. It's not the
cable modem on your desk.
.
_H*

 

CAN is an industry standard, with options for vehicle specific data which Toyota uses extensively. CAN View makes use of this feature.

BEAN and AVC-LAN are Toyota proprietary. Get out your data logger, hack the wiring harness, and good luck reverse engineering...

 

<div class='quotetop'>QUOTE(forrest_fire1 @ Jul 2 2007, 03:25 PM) [snapback]471292[/snapback]</div>

As it happens, my BMW does have two USB 2.0 ports (but its an older model, when I re-do it I may use fire-wire). Here's a pic

[attachmentid=9367]
BYA, I haven't tried any Prius-specific simulations as I haven't updated the vehicle dynamics model I use to incorporate all of the prius oddities.

PS I bet my electric car is quieter than daniel's B)

 

<div class='quotetop'>QUOTE(aeronaut @ Jun 30 2007, 12:09 PM) [snapback]470680[/snapback]</div>

Congratulations for your new Prius and welcome to the PC.

After you crack and change the Prius firmware keep handy the following: :lol:

A Evanston Northwestern Hlthcr www.enh.org
2650 Ridge Ave, Evanston, 60201 - (847) 570-2000

B NW University Health Services www.northwestern.edu
633 Emerson St, Evanston, 60208 - (847) 491-8100

C Evanston Hospital www.enh.org
2650 Ridge Ave, Evanston, 60201 - (847) 570-2000

 

<div class='quotetop'>QUOTE(Bill Merchant @ Jul 1 2007, 10:18 PM) [snapback]471346[/snapback]</div>

It is going to take more than a data logger.... What if the data are transmitted in a proprietary format? You don't have to encrypt the data, just change its format slightly and the level of effort to reverse engineer just grew by a couple of factors.

 

<div class='quotetop'>QUOTE(Bill Merchant @ Jul 1 2007, 10:18 PM) [snapback]471346[/snapback]</div>

Right on.

Lots of luck on that. I've reversed engineered hardware before, but it's been a relatively simple "computer/arcade toy" (the Vectrex) with a known cpu (Motorola 6809), with known machine code etc. That required removing the ROM, disassembling the code (I wrote a 6809 disassembler for my TRS-80), wire-wrapping an interface card to test what changes in the code did, and then writing a replacement ROM(hand coded, since I didn't have an assembler at the time). A case in point: I discovered a line of code that had no recognizable purpose. The results weren't used anywhere else, so it was effectively a NOP. It was part of a raster emulation. When removed, the the text flopped over sideways. With that bit of observation, it was obvious that the instruction was a timing delay, and the timing was critical.

Without already knowing the machine and/or assembly code for the processor, you'd have to be a computer genius and have the guts/stupidity to risk breaking a very expensive piece of equipment. Norm is a lot smarter on this sort of thing than I have, but he's working on the CAN bus, which is at least partially documented.

As others have already noted, it's likely that success even without any other damage, HV battery life would be shortened, and Toyota wouldn't be stupid enough to honor the warranty with a hack like that installed.

Dave M.

 

What might get you more "wow"s is to attempt to make a glide/warp stealth button. Figure out the signal that gets sent when feathering the pedal and make a button (or use one already on the steering wheel)/pedal to send that signal.