I recently had the chance to visit Belgrade and take part in the Hackaday | Belgrade conference. Whenever I travel, I like to make some extra field trips to explore the area. This Serbian trip included a tour of electronics manufacturing, some excellent museums, and a startup that is weaving FPGAs into servers and PCIe cards.
With the summer’s big security conferences over, now is a good time to take a look back on automotive security. With talks about attacks on Chrysler, GM and Tesla, and a whole new Car Hacking village at DEF CON, it’s becoming clear that autosec is a theme that isn’t going away.
Up until this year, the main theme of autosec has been the in-vehicle network. This is the connection between the controllers that run your engine, pulse your anti-lock brakes, fire your airbags, and play your tunes. In most vehicles, they communicate over a protocol called Controller Area Network (CAN).
An early paper on this research [PDF] was published back in 2010 by The Center for Automotive Embedded Systems Security,a joint research effort between University of California San Diego and the University of Washington. They showed a number of vulnerabilities that could be exploited with physical access to a vehicle’s networks.
A number of talks were given on in-vehicle network security, which revealed a common theme: access to the internal network gives control of the vehicle. We even had a series about it here on Hackaday.
The response from the automotive industry was a collective “yeah, we already knew that.” These networks were never designed to be secure, but focused on providing reliable, real-time data transfer between controllers. With data transfer as the main design goal, it was inevitable there would be a few interesting exploits.
There is a device under test out there that promises to take humans to another star in a single lifetime. It means vacations on the moon, retiring at Saturn, and hovercars. If it turns out to be real, it’s the greatest invention of the 21st century. If not, it will be relegated to the history of terrible science right underneath the cold fusion fiasco. It is the EM drive, the electromagnetic drive, a reactionless thruster that operates only on RF energy. It supposedly violates the laws of conservation of momentum, but multiple independent lab tests have shown that it produces thrust. What’s the real story? That’s a little more complicated.
The EM Drive is a device that turns RF energy — radio waves — directly into thrust. This has obvious applications for spacecraft, enabling vacations on Mars, manned explorations of Saturn, and serious consideration of human colonization of other solar systems. The EM drive, if proven successful, would be one of the greatest inventions of all time. Despite the amazing amount of innovation the EM drive would enable, it’s actually a fairly simple device, and something that can be built out of a few copper sheets.
We’ve seen a few people tear down the drive trains from electric vehicles like the Nissan Leaf, Prisuses, or the Chevy Volt. We’ve also seen someone tear down the battery pack found in a Tesla Model S. What we haven’t seen until now is a reverse engineering of the Tesla Model S drive train.
A fortuitous circumstance landed [Michal] the crown jewel of the Tesla Model S – the 310kW, 590Nm drive train. Exactly how and where [Michal] landed this gigantic powerful motor is a question that remains unanswered, and the question unasked. We might not want to know.
Now that he has a motor, the name of the game is figuring out how to drive it. Usually that means capturing data from the CAN bus and replaying that data. This isn’t what [Michal] is doing; instead, he’s using a motor controller he developed for the Chevy Volt and Toyota Prius. It’s going to be a lot of work, but that’s only because these gigantic EV motors and controllers are pretty rare on the used market now. Give it a few years, and the work [Michal] is putting in now will pay off in hundreds of DIY electric vehicles.
The 2015 Hackaday Prize is sponsored by:
[Jay] got a pretty good deal on a low milage Nissan Leaf battery. Unfortunately, it came wrapped in a wrecked Nissan Leaf. There are more and more electric cars on the road each year, and that means there are more cars coming off the road as well due to accidents. Electric cars are specifically designed to protect their batteries, so as we’ve seen before with Tesla vehicles, a salvage car often will still contain a serviceable battery pack. [Jay] used this knowledge to his advantage, and walks us through his experience buying, testing, and dismantling Hoja, his very own salvage Leaf.
[Jay] set up an account on Copart, an auto salvage auction website here in the USA. “Live” online Auto auctions tend to work a bit differently than E-bay, so [Jay] walks us through the process of buying the car, and gives some tips for getting through the process. [Jay’s] particular car was delivered to him on a trailer. It had been rear ended so hard that the rear tires were not usable. The car was also electrically dead. Thankfully, the electrical problems turned out to be a discharged 12 volt accessory battery. A quick charge of the accessory battery caused the Leaf to spring to life – and display a ton of trouble codes. [Jay] cleared the codes with his trusty OBD II scanner, and the car was ready to drive, at least as much as a wrecked car can drive. It did move under its own power though – with the rear end riding on dollies.
Now that the battery was known to be good, [Jay] set about liberating it from its crushed Leaf cocoon. Nissan’s service manual assumes one would be doing this with a lift. [Jay] had no such luxuries in his driveway, so he used 3 floor jacks to lower the 600 lb battery and dollies to pull it out from under the car.
Click past the break for the rest of the story.
If not for [Nikola Tesla], we’d be pretty behind when it comes to electricity. So to pay homage to one of the greatest inventors, [David Choi] decided to make his very own wireless Tesla Desk Lamp!
As expected, [David’s] a big fan of [Nikola], and has always been inspired by his life and experiments — in particular he loves wireless power. Ever since he saw a Tesla Coil light up a bulb from a distance he was smitten. He even named his cat Tesla.
The funny thing is, [David] actually failed physics in high school, but a few years later decided to pursue it as a career while attending Wesleyan University. It didn’t stop when he graduated, he also studied electronic design in his spare time — which is where he learned about resonance.
Wanting to apply what he had learned he has created a very unique wireless desk lamp. Don’t let the pictures fool you; it’s actually 3D printed! It uses one of those retro “vintage” light bulbs, which has it’s power transmitted to it wirelessly by a 6.5MHz signal. It was relatively easy to get the wireless part right, because once he had calculated the number of coils he needed, all he had to do was 3D model the track for the copper to go in.
We covered [wk057] and his Tesla Model S battery teardown back in September. Since then we had some time to catch up with him, and ask a few questions.
You’ve mentioned that you have a (non hacked) Tesla Model S. What do you think of the car?
It’s the best car I’ve ever driven or owned, period. Not to get too into it, but, I love it. I’ve put almost 20,000 miles on it already in under a year and I have no real complaints. Software feature requests… but no complaints. After almost a year, multiple 1700-miles-in-a-weekend trips, and an overall great experience… I can never go back to a gas vehicle after this. It would be like going back to horses and buggies.
A salvage Tesla Lithium battery had to be expensive compared to a Lead Acid setup. What made you go with the Tesla?
Actually, if you consider that the Model S battery is already pre-setup as a high-capacity pack, contains the wiring to do so, and the modules are much more energy and power dense than any lead acid battery bank, it’s actually almost cheaper than a comparable lead acid bank and all the trimmings.
I haven’t officially weighed them, but the modules from the Model S battery are roughly 80 lbs. 80 lbs for a 5.3 kWh battery is around 15 lbs per kWh, which is impressive. For comparison, a decent lead acid battery will have a little over 1 kWh (of low-rate discharge capacity) and weigh almost the same.
Also, the Tesla pack is much more powerful than a lead acid bank of the same capacity.
Generally a lead acid battery bank would have a capacity that would only be realized with slow discharges, so, 1/20C. Much over that and you sacrifice capacity for power. 1/20C for an 85kWh pack is only 4.25kW, barely enough for a central air unit and some lights without losing capacity.
Now the Tesla pack can be discharged (based on how it does so in the vehicle) at up to 3.75C for short periods, and at 1/2C continuously without really affecting the overall capacity of the pack. That means I can run 10x more power than lead acid without a loss in overall charge capacity. Leads to a much more flexible battery solution since the loads will, in reality, always be so low that this will not even come into play with the Tesla pack, but would almost always be a factor with lead acid.
Charging is also somewhat better with the Tesla battery. Charge a lead acid battery at a 1/2C and it will boil. Charge the Tesla pack at 1/2C (42kW) and it might warm up a few degrees. Oh, and the charging losses at high rates are much less than lead acid also.
Overall, without continuing to yack about the technical aspects, it’s just a much better battery, takes up less space, weighs less, and has more power available.
There are likely decent arguments for other solutions, but the rest aside, this one won out because it was definitely more interesting.
Click past the break to read the rest of our interview with [wk057]!