This edition of Fail of the Week is nothing short of remarkable, and your help could really get the failed project back on track. [Snipor Bob] wanted to replace all of the dashboard readouts on his Mustang and got the idea of making the hacked hardware into a Heads-Up Display. What you see above is simply the early hardware proof of concept for tapping into the vehicle’s data system. But there’s also an interesting test rig for getting the windshield glass working as a reflector for the readout.
The jenky looking rig duct taped to the side of the dashboard is actually the kind of stuff we enjoy seeing most. But the idea is to use the character display (mounted elsewhere) as the light source for projecting an instrument cluster on the windshield. [Bobby] is using an STN1110 multiprotocol CAN chip to patch into the bus, pulling the data and driving the display using an Arduino Mega. You might be thinking that this is where he failed since we know from our CAN Hacking series that reverse engineering the databases to make sense of the data is a pain. Luckily he found a chart with all of the codes in it from some dark corner of the Internet. The fail presented itslef when it came time to actually implement the HUD.
The clip below shows his HUD reflection test using a fresnel lens and a pane of glass to stand-in for the windshield. The problem is that to make room for the appropriate focal length he needs to completely remove the instrument cluster from the dashboard. Physically this is not a problem, but it turns out the Passive Anti-Theft System (PATS) monitors the instrument cluster and is triggered if it is removed — preventing the car from starting. Disabling PATS is a no-go for obvious reasons but we’d bet that doing so could invalidate your insurance policy (depending on your underwriter and where you live).
So, give a hacker some advice on this. How can [Bobby] spoof the instrument cluster so that it can be removed without triggering the PATS lockdown?
Fail of the Week is a Hackaday column which runs every Wednesday. Help keep the fun rolling by writing about your past failures and sending us a link to the story — or sending in links to fail write ups you find in your Internet travels.
I didn’t know there was an automotive version of the Arduino.
duct tape FTW!!!!
instead of removing the dash couldn’t he just make a nice blackout for over it?
Certainly. However, part of the goal was to remove the instrument cluster completely to make room for a HUD. Also, I was hoping to put the Arduino and associated electronics in a project box back there. There’s not much room for anything else with the stock instrument cluster in place.
I’m sure an ATMega328P could easily emulate the instrument panel. I would just hit a scrap yard, and tear down a spare instrument panel to find an injection point.
Keep the original cluster and use a larger screen so you don’t need the optics and the space they require.
Or if he’s not doing this just for the sake of hacking, get one of the off-the-shelf automotive HUD projectors.
The problem is that without the optics you can’t get a collimated image. The reflected image would appear to be floating in space only a few feet away, and you have to refocus your eyes from the road to the floating image. Its very distracting. With the optics, the reflected image appears to be far off in the distance and is in focus even when you’re looking at the road. Your eyes don’t have to change focus to read what’s being reflected.
I don’t know of any projectors that do this, but I honestly didn’t spend a huge amount of time searching. I’ll have to check again. It still has to be mounted in such a way that the light is not visible from the front of the vehicle though (for legal reasons), and the most obvious way to do that is put it inside the dash facing up.
Valid point, but is it really any different from having to focus your eyes between normal dashboard instruments and the road?
No, but the point of a HUD is to have an image that appears to be at infinite focal range letting you see it at the same time as the objects outside the vehicle. Less eye strain, and it lets you look at readouts while keeping other objects in better focus in your peripheral vision.
Looking away from the road to look at a dark instrument panel (day) or bright instrument panel (night) doesn’t just mean you need to refocus, you also change the aperture of your eyes meaning you can hardly see anything at all in your peripheral vision while looking at the instrument panel.
Instead of projecting up from the dashboard, project down from the visor area to the dashboard and reflect it up into the windshield? I see you’re using a gigantic lens and LCD picture frame but my idea would work best with a micro projector and a polarized mirror.
There isn’t really enough room to mount a projector up high. It may be possible, but I would risk hitting my head on it in the event of an accident. Also, it is illegal to have light shining out of the front windshield, and it would be nearly impossible to come up with a way to hide the projector from view.
Here you go:
http://www.ebay.com/itm/Omega-PASS-3-pass3-Ford-PATS1-Anti-Theft-System-Bypass-DB-PASS-3-/360780263516?pt=US_Car_Keys_Transponders&hash=item54002df05c&vxp=mtr
This will bypass pats. I had to do the same thing on my 70 Chevelle LS swap, since it was the original mechanical gauges.
I can turn PATS off already. The ECU reprogrammer I have for tuning my car can disable it. I want PATS to actually work though, because when its disabled it is a trivial task to steal the car.
These kinds of debates are always interesting. If you can disable PATS on your car, then anyone can disable it if they have the right doohickey to plug into the vehicle. Seems to be self defeating.
I was actually going to comment that the point of the PATS system is defeated if there were a way around it. Now it seems there is a way around it, so the car is no more secure than it was before PATS was developed…
You’re over thinking it.
Just flip the display and set it on the dash.
Torque has it in their diagnostic app. (so you can look and see how they did it if you can’t figure it)
Works fine for my phone in my truck (windshield further away), so it should be great for that large display and his car.
That large display was just a digital picture frame used to test the idea of a collimated image for the HUD. It wasn’t what I was planning on using. Also, simply reflecting an image off a windshield gives you an uncollimated image. It appears to be floating in space a few inches from the windshield, as opposed to a collimated image that appears to be at a far away distance. With a collimated image you don’t have to refocus your eyes between the road and the image on the windshield.
The bypass in the link i left will not disable it in the ECU, which is what you can not do unless you have swapped it out with a pre-1996 car, as in my case. So technically the pats is still active and you can pass inspection just fine.
It seems there is a typo in the chips name. It is an STN1110. The T and N got swapped.
Depending on what data you need to pull, it may just be easier to get off the ODBII port. Using a bluetooth ODBII adapter and an app on my phone, I can see the speed, RPM, and any other presentable data. Seems much safer.
Why do you need to show speed on your phone ? why did you buy car, which dont have that thing to show you your speed ? :)
My speedometer is a little off and I wanted to see the GPS speed compared to the ECU-reported speed. I also get intermittent check engine lights and wanted to see what was causing it.
+1
A lot of cars have issues with incorrect speed readings, often due to non-factory tires. I put slightly larger sized tires (215 65 15 -> 225 75 15) on my Jeep and my readings are off.
Oh yes, far more safer than looking at that highly dangerous speedometer on the dashboard. Those things are going to get people killed!
I am getting the data off the OBDII port via the STN1110. The STN1110 connects to the OBDII port, and the arduino connects via serial to the STN1110.
The fail started with him not doing the math so that even before the project was started you could see that the display was not going to fit with the magnification.
Nope. The project would definitely fit, but I have to get the instrument cluster out of there and replaced with something thinner. Also, I wasn’t planning on using that huge fresnel lense and picture frame. I would have picked something more sensibly sized. Although, with the gauges gone I probably could actually fit that giant lense and picture frame.
FYI, fartface is a legendary troll. Like, a literal troll. The under-a-bridge kind.
I had an old nissan 240sx with a HUD that displayed only the speedo. It was mounted on the dash and sat pretty close to the windshield and i believe it had some sort of partially reflective static cling sticker on the inside of the windshield where the information was projected. No special lenses needed. I found a picture on google of someone else’s car with the stock HUD. http://carphotos.cardomain.com/ride_images/4/535/2969/38836484002_large.jpg
Ditto. When I did my driving lessons, the instructor had a little GPS speedo thing like that mounted on the dash. You just see its reflection in the windscreen – didn’t even need any reflective film or anything, since the display is so bright.
The important thing to remember is to mirror the display characters!
Now that you mention it. I think the reflective film was added by another owner to increase daytime visibility/contrast.
I was actually leaning towards using an additional piece of glass instead of reflecting the image off the windshield glass. The problem with reflecting the image directly off the windshield is that you get a double reflection. One reflection from the inside of the windshield, and one reflection from the outside of the windshield. If you look at the image you posted a link to, you can clearly see that there is both the bright number 0 reflecting off the inside surface of the glass, and also a dimmer duplicate number 0 reflected from the outside surface of the glass. The dim second reflection is situated slightly higher up because of the angle of the windshield. If you use an LCD (which is polarized) and put up a polarized filter on the first surface, it blocks/reflects all the light and eliminates the double image. There is a minor issue with doing that to a windshield because it is illegal (where I live) to put anything on your windshield except along the very top edge. Using a separate piece of glass arranged like the classic fighter HUD and coated with a polarized film would eliminate the double image problem and be legal too.
It might be a problem with newer windshields but I don’t recall any significant double image problems. Also, if you look at the picture again you’ll see the that everything on the dash is actually doubled do to the long exposure time of the camera.
http://i50.tinypic.com/2iloahy.jpg no double image
The main immo routine is located in the Engine Control Unit. It shouldnt be too hard to disable, just need to check which ECU does the target car have. Feel free to drop me an email if any help is needed with that!
I could disable it. I have the ability to. I have an ECU reprogrammer for tuning my car, and one of its abilities is disabling PATS. The thing is, I still want PATS to function. It does a decent job preventing theft. It’s not hard to use a hammer and screwdriver to force the ignition to the run/start position, so I want the additional protection PATS gives.
My email was wrong on previous comment, good one is brd_gsm(not with dot).
Great project btw!
Bounce it off a couple of mirrors before you put it up on the windscreen.
The PATS system shares data between the PCM and the instrument cluster. I believe the cluster stores the shared ID, as well as the info for the coded ignition keys. If you are removing the dash, just leave the wiring and instrument cluster. You could also modify the instrument cluster, just don’t break it, since that’d probably force you into buying another cluster and having the dealership reprogram the system. When any component of the PATS system detects a fault, the PCM locks out your ignition, (in the case of my truck, the starter will roll, but you will have no fuel or spark.)
And by modifying, I really meant removing the unnecessary bits, like the stepper motors, any light bulbs, and possibly desoldering or cutting traces to the LED’s to keep it dark..or just use black tape). I haven’t tried this with my ford, but I know it’s fairly easy to do this on a GM cluster.
I did think about doing this, but for resale reasons (in case I ever need to sell the car) I want to have a fully functional stock instrument cluster. This would certainly work though.
Actually the PCM stores the key information. The ICM (Cluster) does not start storing the Key codes till 2005MY.
Interesting. That is encouraging to some degree. So I take it the instrument cluster is involved somehow in a “system ok” check of sorts, as opposed to having stuff programmed in to it. I would then assume this is mainly to prevent people from swapping instrument clusters out with lower mileage ones? So I guess I would need to duplicate some sort of response that the PCM is expecting?
Schmidt Cassegrain scopes accomplish long focal lengths in short bodies with mirrors and a corrector glass plate.
I’ve never heard of them before. I’ll have to look that up. Thanks!
Can you cut a hole in the dashboard to situate the screen lower down? or is there stuff in there
Indeed. This is what I would have to do. Instead of cutting the original dash, I was going to make a duplicate out of fiberglass and cut a hole in that one. That way if I ever needed to put the car back to stock (like to sell it or trade it in or something) I still could.
Reading your comment again, I misunderstood it at first. The steering column comes up to the bottom of the instrument cluster. I could mount the LCDs and stuff lower and to the left/right of the steering column, but that still leaves the stock instrument cluster in place. I want to get the stock instrument cluster out of there because it is quite large, and in its place I was going to put the lenses/mirrors for the HUD. I would then make a hole in the top of the dash to reflect the image off the windshield (or potentially a polarized film on a piece of angled glass to give it an authentic HUD look).
can you put the instrument cluster somewhere else out of the way, and just extend the connections?
Not really. The instrument cluster is surprisingly large. It would of course fit in the trunk, but it would be crushed over time by the toolbox and jackstand I keep in the trunk.
That is a 1999-2004 Mustang. It does NOT use CAN protocol. It uses PWM – J1850. On a separate note, PATS can be disabled in the PCM. This can be done by any tuner, or via IDS and a VCM.
You are correct sir. It is indeed PWM J1850. I award you one internet! :)
I could disable PATS with my tuner, but I don’t want to. With PATS disabled, these cars can be stolen with a hammer and screwdriver in a few seconds. My (far fetched) hope is to find a way to remove the instrument cluster while keeping PATS functional.
There are some GPS units that are designed act as a HUD, pretty sure Garmin makes one. Also what would happen if the MIL came on with the dash removed? If he didnt know about PATS I doubt he added MIL light functionality to this.
I had planned to deal with the check engine light. For the record I was aware of PATS too, I just didn’t know it tied in to the instrument cluster. Anyway, I have somewhere a list of every error code along with a description and likely cause of the code. In the event of a code, the arduino was going to display the code and the description and the probable cause on an LCD. It would have been a million times more useful than the standard idiot light.
Have you considered building an AR rig instead of a HUD? Possibly a future project, but it would eliminate a lot of the problems you seem to be having because you wouldn’t have to remove the dashboard.. just don the Augmented Reality glasses (ala Google Glass or build your own) and tie those into the arduino. Just a thought.
That could work. I know nothing about making such glasses though. I had always assumed that the necessary optics would be beyond my ability to create.
How about:
– get a duplicate instrument cluster from junkyard
– strip down duplicate cluster to just the parts PATS wants to see (by removing displays, etc)
– swap stripped down circuit board with original cluster (which you keep in case you ever sell the car)
– stuff stripped circuit board under dash somewhere, secure with duct tape (looks like you already have this down)
I don’t think that will work. I believe that a particular instrument cluster is tied to the computer through some sort of unique id, so swapping the original cluster with a different one will cause the car to not start.
Why not disable the factory PATS system and implement your own? Use a few relays to cut off fuel, spark, and crank. Hide an RFID reader in steering column and connect to the ‘duino and tag your keys, or keep a card in your wallet and stuff the reader under the seat. Even better, have your butt chipped, so your car literally requires you in the seat to operate.
I wanna get an RFID tag in my butt now, just for this. and maybe a “welcome Michael” voice when I get in too…
I wanna get my butt chipped just for this. And maybe a “welcome Michael” in KITT’s voice too…
I don’t want to get a butt chip for two reasons. 1, that would hurt, and I’m not super fond of the idea of embedding an electronic tracking device into myself. 2, I do need the car to start for other people, in case someone needs to borrow or drive my car for some reason.
The diy relay system sounds like a good idea though. I may look into that. As long as there is an easy way to put it back so it functions like stock, it sounds like this may be the way to go.
make a very long harness and put it in your trunk, Had to do this for the stock radio in a monte carlo years ago to replace the radio as part of the anti theft was in the stock radio
It would get messed up in my trunk. I have to drive around with a jack stand and toolbox back there. I usually take corners in an enthusiastic (but not ridiculous or unsafe) manner, and the stuff goes flying all over the place.
How about getting a UK dashboard (ie right hand drive), and moving the dashboard to the passenger seat? this gives your RIO the dials for information, and a tidy fix. Another option might be to trace the wiring loom to see if there is a chip or similar that’s reporting to the PATS.
An interesting idea. I think it would require a fair amount of modification to make it fit (needs a cutout for the steering column and such). Also the passenger would lose their airbag. If I install a racing seat and harness (I probably will some day) then its not a big deal.
There isn’t a chip or anything in the loom, its in the instrument cluster itself. I’m honestly a little nervous opening it up in case it has some sort of tamper proof stuff inside. As someone else commented, it should be possible to remove the needle motors and lights and stuff, but I want to keep the original gauge cluster intact in case I have to sell the car or something.
Why not get a “Key In” PATS bypass? You know, the old fashion type bypasses that require you leave a key in the car? Wire the remote start trigger into your ignition, either on ACC or crank? I’m no hacker, i just enjoy reading these articles. But why not move the sensor ring from the fake ignition to the real ignition. That way, when your key is in the ignition, PATS is “Bypassed”?
So you want advice on disabling factory automotive security?
From web randoms? Haha. Just pay an auto electrician. We do this often.
He should get a CANBus Triple!