The Progressive Snapshot is a small device that plugs into the ODB-II port on your car, figures out how terrible of a driver you are, and sends that data to Progressive servers so a discount (or increase) can be applied to your car insurance policy. [Jared] wondered what was inside this little device, so he did a teardown. There’s an Atmel ARM in there along with a SIM card. Anyone else want to have a go at reverse engineering this thing from a few pictures?
[Alex]’s dad received a special gift for his company’s 50th anniversary – a Zippo Ziplight. Basically, its a flashlight stuffed into the metal Zippo lighter we all know and love. The problem is, it’s battery-powered, and Zippo doesn’t make them any more. It also uses AAAA batteries. Yes, four As. No problem, because you can take apart a 9V and get six of them.
‘Tis the season to decorate things, I guess, and here’s a Hackaday snowflake. That’s from [Benjamin Gray], someone who really knows his way around a laser cutter.
HHaviing trouble wiith a debounce ciircut? HHer’s a calculator for just thhat problem. Put iin the logiic hhiigh voltage level, the bounce tiime, and the fiinal voltage, and you get the capaciitor value and resiistor value.
A harmonograph is a device that puts a pen on a pendulum, drawing out complex curves that even a spirograph would find impressive. [Matt] wanted to make some harmonographs, but a CNC and a printing press got in the way. He’s actually making some interesting prints that would be difficult if not impossible to make with a traditional harmonograph – [Matt] can control the depth and width of the cut, making for some interesting patterns.
The Mooltipass, the Developed On Hackaday offline password keeper, has had an interesting crowdfunding campaign and now it’s completely funded. The person who tipped it over was [Shad Van Den Hul]. Go him. There’s still two days left in the campaign, so now’s the time if you want one.
I thought the Progressive Snapshot was just a recording device, but apparently it is cellular? Not able to discern from the pictures, there probably is an accelerometer (MEMS) device to check for jackrabbit starts and stops and hard corners. Using the output of the car computer and triangulation from cell towers, they could also know if you are a speeder.
Just wait until the average American sees those pictures and then thinks it’s yet another NSA spy gadget. (Which it very well could be, more reverse engineering needed…)
TBH I don’t care if it’s the NSA, Google, Progressive or anyone else tracking where I am and what I do. It makes me uneasy all the same.
It includes some sort of cellular modem. They knew when I plugged it in, and when I unplugged it, as well as the zip code. They start adjusting your rate after you have it plugged in for about a month.
interesting mini header inside the plug shroud (4 tiny pins) you can see where they link to the back side of the board.
so wonder if that is a uart/serial connection.
also can see 4 other bare pads at the other (rounded end of the board)
Yay Mooltipass!
Yeah, way to go Mathieu and the mooltipass devs! Congrats.
Speaking of reverse engineering, not sure if anyone’s every gotten into car cameras before? Got this piece of shh that has a no name China chip and some hynix hy57v64 DRAM chip, there’s barely any info on it besides Russians with their car cameras lol. Here’s a very similar pic of the top: remont-aud.net/_bd/95/82383696.jpg and on bottom remont-aud.net/_bd/95/78708465.jpg , it won’t connect easy via USB, the firmware sucks beyond all hell, and can only store tiny videos in sdcard. I want to just stream the video to a media player on a PC. Any clues anyone? Its about to become a practice soldering board… :(
I see two possible j-tag/usb connections on the Progressive Snapshot.
One at the main connector side and on the tip of the “mainboard”
Nice photos! I can’t make out the modem maker, but the rest looks pretty straightforward.
I’m betting the 4-pin jobby in the OBD connector is UART, but you’re right, USB is a possibility too. First, apply power to pin 16 and ground to 4/5, and see if one’s connected to internal Vcc. Then, logic-analyzer on the middle two, see if you get a spew of UART as it boots. Go from there.
The question then is whether that gets you talking to the modem chipset, or to the embedded uC. Probably the former, as the uC would’ve been programmed once at manufacture-time, and I bet this externally-accessible port is for serialization at ship-time. Gotta have a way to verify the ICCID so it can be associated with a customer, and that’s under the control of the modem.
Amusingly, it looks like the mainboard has dual footprints, for two variants of the modem module. Solder mask covers the unused pads, but they only have to make the copper once and then choose the mask based on which module is going into the product. This might be for regional/international versions (different cellular bands), or it might be for availability reasons — modules go in and out of production and you want flexibility.
Note the green wire between the power board and the base board. That’s probably an EMI or stability fix discovered late in development, with a few thousand units hand-reworked before the new PCB rev was ready.
I see what you did there (with the summary of the debounce calculator)
I was going to complain about it, (facepalm)
Regarding the Snapshot, the device is a Xirgo XT-3200 series tracking device. I work with the XT-2100 and XT-2000 series devices as well for a living. The devices run FreeRTOS and are actually quite simple devices. They send position reports and other data over UDP at a configurable rate. They also don’t implement DNS (at least on the firmware versions we’re using) which makes them a bit inflexible. You can change the IP address they report to and other settings over the 4-port UART at the bottom of the device (low voltage, and I’m fairly certain it’s not a USB connection).
You can find a bit more information about these devices and the others here: http://www.xirgotech.com/products-page . Unfortunately the protocols they speak are not publicly documented, however you might have some luck talking to the Xirgo guys, or looking into the OpenGTS project.
Awesome, thanks!
Did a quick Google search on most of the Visible ICs.
Results:
Daughter Board (Apparently for Power)
AD-8504-CZ Buzzer
54232 TI Chip Step-Down DC-DC Converter
Main Board
MX25L1606E CMOS serial flash memory
Atmel ARM Couldn’t get a positive match
None of these are the accelerometer I was expecting, but there is still one good candidate. On the Main board (Underneath the 35V capacitor on the daughter board) there is an IC that unhelpfully starts with an “I”
Here is what Progressive claims to track
“What information does the device collect?
For each trip you take, Snapshot notes information like the distance, time of day and how you drive, including any hard brakes. It also collects your vehicle identification number and triggers an email to you if it comes unplugged.
Some devices also collect location data: We collect it only as part of our ongoing efforts to improve Snapshot—we don’t use it to calculate your rate.”
To gather what they claim, I don’t think they need anything more than an accelerometer, onboard GSM, and the OBD-II Port.
Depending on their definition of “hard brakes”, that might just be a count of the number of times the ABS kicks in, or simply some count of the number of times Vdelta-over-last-n-seconds exceeds some threshold. That data would be available/derivable from the OBD-II port without an accelerometer.
Reading http://www.xirgotech.com/xt-3200-series after posting – they claim there’s an accelerometer in there, so carry on with the treasure hunt… :-)
You still made a good point. Since the direction of a car is assumed to be forward, there is no need for a 3D accelerometer. As long as long as the the OBD-II has a high enough refresh rate for speed data, it can easily calculate changes in acceleration (like braking). An accelerometer is only needed for detecting things like sharp turns and swerving.
Hmm, but maybe the orientation of the OBDII port is not standardized, (yes, located under the driver’s side dash in US (left hand drive?) cars), but otherwise multi-axis would be needed to compensate for different orientations of the socket.
A “hard brake” includes anything that causes any tire lock, it seems. Part of the reason I did this teardown when I did, was because during the first snow, any side-street braking led to it beeping at me for a “hard brake”.
I tried one for a while and am not an aggressive driver at all. The thing beeped all the time. It’s more likely to encourage people to run red lights and not slow down for corners than it is to get them a discount. There was no way I was ever going to get a discount, so I sent it back. I haven’t had an accident or a ticket in over 20 years.
Yeah, I would have bent the antenna back, but it was glued to foam that was glued to the rest of the board. As cool as a full teardown would have been, I didn’t feel like spending $50 for a handful of pictures.
Another string that might interest you: “XPYLEONG100”
“Snapshot notes information like…”
The key word here being “like” of course.
The “Accelerometer” on the “Progressive snapsnot” is the white tube with golden ends, seen on the first picture. It’s a ball within a tube that slams against the ends. The angle of this tube denotes the sensivity, and as not all cars have the ODB-port at the same angle, it seems like a pretty bad construction!
One of these? http://www.fastimaging.com.hk/en/products_class.php?id=7
SQ-SEN-390
SQ-SEN-8XX
SQ-SEN-6XX
SQ-SEN-200
For some of the part numbers. Too lazy to download the datasheets though.
If there’s metal balls in there, stick a magnet on the side and be done with it.
Exactly.
Nice find. But after looking at the datasheets for these products, I don’t think that they could be the main source of acceleration data. Most of the models are just tilt switches and like Zaprodk said this would not work due to the diverse mounting angles of different car models.
But the SQ-SEN-200 is different. It is actually a vibration sensor, not a normal tilt sensor. I’ll quote a bit of the datasheet that shows what this part is likely for.
“When at rest, it normally settles in a closed state. When in motion, it will produce continuous on/off contact closures.” … “The signal level can be read directly by a digital input. This can be used to interrupt (wake up) a microcontroller or can be counted to estimate the amount and duration of activity.”
OBD-II ports always have power available to them. It makes sense to put the device into sleep mode while the car is not in motion to prevent cellular data transmissions from eating away at the battery.
Well, I just found the SQ-ASX Series which comes in the same package and is actually a “Shock and Acceleration Sensor”. It comes preconfigured to sense a set number of G’s and can work omni-directionally. I guess that this part could be the “accelerometer” that Xirgo Tech. talks about in the product page after all.
Progressive Snapshot was just a recording device, but apparently it is cellular
To hell with the insurance savings. Someone write the s/w to reprogram it into a tracking device to use yourself. Sure would make a quick and easy install to say track a cheating spouse. Hell figure out how to add a mic as well. Sorry I posted this twice but forgot to check the box to be notified of any new comments…